I have added the following line:

```
$userquery = mysqli_real_escape_string ($db, $userquery);

```

To the code that worked before I added it, and now I get the following 2 errors:

```
 mysqli_real_escape_string() expects parameter 2 to be string, object given 

```

**AND**

```
mysqli_num_rows() expects parameter 1 to be mysqli_result, null given

```

**Code** 

```
  $userquery = mysqli_query($db, "SELECT * FROM staff WHERE forename = '$forename'") or die ("error getting information from database.");
    $userquery = mysqli_real_escape_string ($db, $userquery);
    if (mysqli_num_rows($userquery) == null ){
        die ("No staff directory found");
    }

```

Can anyone tell me why I'm getting these errors and what I can do to fix them?

I understand the first error is because of $userquery being used twice, but if i dont use it twice how can I use the mysqli\_real\_escape\_string extension?

*I have tried changing the variable names of the first $userquery which gets rid of the errors but then the new error occurs:*

```
mysqli_real_escape_string() expects parameter 2 to be string, object given

```