Upgrading Custom Extension for PHP 7: How to I instantiate a mysqli data object
CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like mysqli_real_escape_string. You can use it in 2 ways:


Parameterize your query like this:

CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
  [1 =&gt; [$id, 'Integer']]
);

Escape your variables beforehand with CRM_Utils_Type::escape().