problem with "real_escape_string"

Question

i am having some troubles my the "real_escape_string" and i need some help

login.php

<?php include('Connections/local.php'); ?>
<?php
function GetSQLValueString($sql) {
    $sql = $mysqli->real_escape_string($sql);
    return $sql;
}
?>

local.php

<?php
$hostname_local = "xxx";
$database_local = "xxx";
$username_local = "xxx";
$password_local = "xxx";
$mysqli = new mysqli($hostname_local, $username_local, $password_local, $database_local);
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}
?>

the error is

Undefined variable: mysqli

i've tried some things ( like moving the content of the local.php inside the login.php ) but nothing works

Answer 1

You can't access $mysqli inside your function. If you want to, add global $mysqli; in your function to make it accessible. Alternatively, you could pass the $mysqli as a parameter.

Answer 2

Why not just use the function call directly.

My suggestion, just create a simpler (and easier to read function) called "esc" and use that anytime you need to escape anything sql related.

 function esc($string, $mysqli = false) {
    if (!$mysqli) global $mysqli;
    return mysqli_real_escape_string($mysqli,$string);
 }

And then just use this by doing the following:

 $sql = esc($string); //if $mysqli is already set globally, and thus will be inherited by the function

OR

 $sql = esc($string,$mysqli); //if $mysqli is to be passed into each func call