API POST to save a new item in a Database via PHP & MYSQLI Is this correct MYSQLI implementation?
IS it safe from injection?
IS the object cleanup done properly?

&lt;?php

include_once '../../securelogin/db_connect.php';
include_once '../../securelogin/functions.php';

sec_session_start();

if (login_check($mysqli) == true)
{
    $con = new mysqli("localhost", "username", "password", "databasename_todo");

    // Check connection
    if ($con-&gt;connect_errno)
    {
        echo "Failed to connect to MySQL: (" . $con-&gt;connect_errno . ") " . $con-&gt;connect_error;
    }
    else
    {
        $jsonText = file_get_contents('php://input');
        $decodedText = html_entity_decode($jsonText);
        $myArray = json_decode('[' . $decodedText . ']', true);

        $newText = $myArray[0]['TEXT'];
        $newOwnerID = $myArray[0]['OWNER_ID'];
        $newCreateDate = date("Y-m-d"); 
        $newCompleted = 'N';

        $newText = mysqli_real_escape_string($con, $newText);

        if(!($sql = $con-&gt;prepare("INSERT INTO checklistitems (TEXT, OWNER_ID, COMPLETED, CREATE_DATE, CREATE_USER) VALUES (?,?,?,?,?)")))
        { echo "Prepare failed: (" . $con-&gt;errno . ") " . $con-&gt;error;}

        if(!$sql-&gt;bind_param('sissi', $newText, $newOwnerID, $newCompleted, $newCreateDate, $newOwnerID))
        {echo "Binding parameters failed: (" . $sql-&gt;errno . ") " . $sql-&gt;error;}

        if(!$sql-&gt;execute())
        {echo "Execute failed: (" . $sql-&gt;errno . ") " . $sql-&gt;error;}

        echo "SUCCESS - Affected rows ADD: " . $con-&gt;affected_rows;

        $sql-&gt;close();
    }

    $con-&gt;close();
    $con = null;
}
else
{  
    echo "Error! You are not authorized to access this page. Please login.";
}
?&gt;
What are these lines all about?

$thread = $con-&gt;thread_id;
$con-&gt;close();
$con-&gt;kill($thread);
$con = null;


it seems a bit, sorry for the pun, overkill. According to the PHP manual this should do just fine:

$con-&gt;close();


but even if you leave it out, the connection will be closed automatically when the script terminates. See:

http://php.net/manual/en/mysqli.construct.php

read the examples, and see:

http://php.net/manual/en/mysqli.close.php