Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given... what I do wrong?

Question

I try make php login but I get this error: Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given, what I do wrong?

register.php

<!doctype html>
<html lang"fi">
<head>
<link rel="icon" type='image/png' href='images/logo.png'>
<title>
asd
</title>
<link href="css/styles.css" type="text/css" rel="stylesheet">
</head>
<body>
<!--reg alkaa-->
<form action="register.php" method="post">
<p><input type="text" name="username" placeholder="Username">
<p><input type="email" name="email" placeholder="Email">
<p><input type="password" name="pass" placeholder="Password">
<p><input type="password" name="pass1" placeholder="Password">
<p><input type="submit" name="submit" value="Register">
</form>
<?php

if(isset($_POST['submit']))
{
$username = mysqli_real_escape_string($_POST['username']);
$pass = mysqli_real_escape_string($_POST['pass']);
$pass1 = mysqli_real_escape_string($_POST['pass1']);
$email = mysqli_real_escape_string($_POST['email']);
if($username && $pass && $pass1 && $email)
{
if($pass==$pass1)
{
    $connect = mysql_connect("mysql.example.com","username","password");
    mysql_select_db("my_database");
    $query = mysql_query("INSERT INTO users VALUES('$username','$pass','$email');");
    echo "You have been registered.";
}
else
{
    echo "Password must match.";
}
}
else
{
echo "All fields are required.";
}
}
 ?>
<!--reg end-->
<Center>
<a href="index.php">
<h1>
asd
</h1>
</center>
<div id="main">
<h3>
 <div class="menu"> <a href="index.php">Etusivu</a> &bullet; 
 <a                                       </div>
</h3>
</div>
<div class="jonne"> 
</div>
<script src="javascript/jquery.js"></script>
</body>
</html>

I use 000webhost and this first time when I use mysql databases online.

score 54 · Accepted Answer · edited Sep 07 '14 at 07:11

You are mixing mysqli and mysql function.

If your are using mysql function then instead mysqli_real_escape_string($your_variable); use

$username = mysql_real_escape_string($_POST['username']);
$pass = mysql_real_escape_string($_POST['pass']);
$pass1 = mysql_real_escape_string($_POST['pass1']);
$email = mysql_real_escape_string($_POST['email']);

If your using mysqli_* function then you have to include your connection to database into mysqli_real_escape function :

$username = mysqli_real_escape_string($your_connection, $_POST['username']);
$pass = mysqli_real_escape_string($your_connection, $_POST['pass']);
$pass1 = mysqli_real_escape_string($your_connection, $_POST['pass1']);
$email = mysqli_real_escape_string($your_connection, $_POST['email']);

Note : Use mysqli_* function since mysql has been deprecated. For information please read mysqli_*

score 3 · Answer 2 · answered Sep 03 '14 at 05:43

From the documentation , the function mysqli_real_escape_string() has two parameters.

string mysqli_real_escape_string ( mysqli $link , string $escapestr ).

The first one is a link for a mysqli instance (database connection object), the second one is the string to escape. So your code should be like :

$username = mysqli_real_escape_string($yourconnectionobject,$_POST['username']);

score 1 · Answer 3 · answered Sep 03 '14 at 05:43

mysqli_real_escape_string function requires the connection to your database.

$username = mysqli_real_escape_string($your_connection, $_POST['username']);

P.S.: Do not mix mysql_ functions* and mysqli_ functions*. Please use mysqli_* functions or PDO because mysql_* functions are deprecated and will be removed in the future.

score 1 · Answer 4 · answered Sep 03 '14 at 05:44

1

you are mixing mysql and mysqli

use this mysql_real_escape_string like

$username = mysql_real_escape_string($_POST['username']);

NOTE : mysql_* is deprecated use mysqli_* or PDO

answered Sep 03 '14 at 05:44

Satish Sharma

9,547
6
29
51

score 1 · Answer 5 · answered Sep 03 '14 at 05:46

If you use the procedural style, you have to provide both a connection and a string:

$name = mysqli_real_escape_string($conn, $name);

Only the object oriented version can be done with just a string:

$name = $link->real_escape_string($name);

The documentation should hopefully make this clear.

score 1 · Answer 6 · answered Aug 25 '18 at 09:51

The following works perfectly:-

if(isset($_POST['signup'])){
$username=mysqli_real_escape_string($connect,$_POST['username']);
$email=mysqli_real_escape_string($connect,$_POST['email']);
$pass1=mysqli_real_escape_string($connect,$_POST['pass1']);
$pass2=mysqli_real_escape_string($connect,$_POST['pass2']);

Now, the $connect is my variable containing my connection to the database. You only left out the connection variable. Include it and it shall work perfectly.

score 0 · Answer 7 · answered Sep 03 '14 at 05:45

0

pass $connect as your first parameter in mysqli_real_escape_string for this first make connection then do rest.read here http://php.net/manual/en/mysqli.real-escape-string.php

answered Sep 03 '14 at 05:45

Suchit kumar

11,809
3
22
44

score 0 · Answer 8 · answered Sep 03 '14 at 06:07

0

Use this way instead of your way.

    addslashes(trim($_POST['username']));

answered Sep 03 '14 at 06:07

max3000

19
6

For avoid the special characters use java script validation in front end. – max3000 Sep 03 '14 at 06:09
2

That's not a safe way of escaping strings for MySQL. – Synchro Sep 03 '14 at 06:28

score 0 · Answer 9 · answered Dec 03 '17 at 13:47

There is slight change in mysql_real_escape_string mysqli_real_escape_string. below syntax

mysql_real_escape_string syntax will be mysql_real_escape_string($_POST['sample_var'])

mysqli_real_escape_string syntax will be mysqli_real_escape_string($conn,$_POST['sample_var'])

score -1 · Answer 10 · answered Sep 03 '14 at 07:35

-1

Replace your query with the following:

$query = mysql_query("INSERT INTO users VALUES('$username','$pass','$email')", `$Connect`);

answered Sep 03 '14 at 07:35

Ethic Or Logics

111
1
13

score -2 · Answer 11 · edited Feb 17 '16 at 16:31

-2

use mysql_real_escape_string() instead of mysqli_real_escape_string()

like so:

$username = mysql_real_escape_string($_POST['username']);

edited Feb 17 '16 at 16:31

ahmed hamdy

5,096
1
47
58

answered Sep 03 '14 at 05:50

Obi Ik

159
2
9

mysql has been deprecated – WendiT Sep 09 '17 at 08:09

Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given... what I do wrong?

11 Answers11

Linked

Related