PHP mysqli_real_escape_string returning empty string

Question

The code works fine if I don't use the mysql_real_escape_string function. But the function is returning nothing! I read that the problem may be due to the fact that I do not have a mysql connection but that does not seem to be the case!

Please help!

<?php
$con=mysqli_connect("localhost","root","pwd","mysql");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }

$title = mysqli_real_escape_string($_POST["title"]);
$comment = mysqli_real_escape_string($_POST["comment"]);
$type = $_POST["type"];
$time = date("Y-m-d H:i:s");


$sql="INSERT INTO posts
VALUES
('','$type','$time','$time','$title','$comment','0','0','0','0','0')";

if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }



mysqli_close($con);
header ("location: index.php");
?>

Why do you escape $_POST["title"] but not $_POST["type"]? — cdhowie
– cdhowie, Commented Jul 24, 2013 at 16:24

cmorrissey · Accepted Answer · 2013-07-24 16:24:54Z

9

You need to pass the connection to the function

$title = mysqli_real_escape_string($con, $_POST["title"]);

answered Jul 24, 2013 at 16:24

cmorrissey

8,5912 gold badges26 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Charlie Liu Over a year ago

ya I know, I had to wait 8 minutes before I could accept it :)

Verran · Accepted Answer · 2013-07-24 16:29:56Z

2

According to http://php.net/manual/en/mysqli.real-escape-string.php you need to pass two parameters unless you are using the object oriented style.You should be using the format:

mysqli_real_escape_string ( $link , $escapestr )

Where $link is: A link identifier returned by mysqli_connect() or mysqli_init()

And $escapestr is: The string to be escaped. Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", and Control-Z.

answered Jul 24, 2013 at 16:29

Verran

4,0822 gold badges17 silver badges22 bronze badges

Comments

Martijn · Accepted Answer · 2013-07-24 16:28:35Z

0

php.net says
Procedural style
mysqli_real_escape_string ( mysqli $link , string $escapestr )
So you will need to add your $con to it:
$title = mysqli_real_escape_string($con, $_POST["title"]);

answered Jul 24, 2013 at 16:28

Martijn

16.2k4 gold badges39 silver badges73 bronze badges

Collectives™ on Stack Overflow

PHP mysqli_real_escape_string returning empty string

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related