title: error in mysqli_real_escape_string()?
body: <p>Here, i am creating the signing up a new user form but i got a problem in <code>mysql_real_escape_string()</code> .so, i used the alternative <code>mysqli_real_escape_string()</code> and i tried </p>
  
  <pre><code>mysqli_real_escape_string($conn,$_POST['user_name'])
  </code></pre>
  
  <p>but didn`t worked .Here, i have created a separate connect.php(for the connection with the server and database) file in order to save my time  and i have include that file in signup.php file using  </p>
  
  <pre><code>include 'connect.php';
  </code></pre>
  
  <p>and i am not sure by making separate connect.php file <code>mysqli_real_escape_string($conn,$_POST['user_name'])</code> can be use or not.</p>
  
  <h2>connect.php</h2>
  
  <pre><code>&lt;?php
      $server='localhost';
      $username='root';
      $password='';
      $db_name='web_forum_db';
  
      if(!$conn=mysqli_connect($server,$username,$password))
      {
          exit('Error: could not establish database connection');
      }
  
      if (!mysqli_select_db($conn,$db_name))
       {
          exit('Error: could not select the database');
      }
      mysqli_close($conn);
  ?&gt;
  </code></pre>
  
  <hr>
  
  <h2>signup.php</h2>
  
  <pre><code>&lt;?php
      include 'connect.php';
      include 'header.php';
      echo '&lt;h3&gt;Sign up&lt;/h3&gt;';
      if($_SERVER['REQUEST_METHOD'] !='POST')
      {
          echo '&lt;form method="POST" action=""&gt;
          Username:&lt;input type="text" name="user_name"/&gt;
          Password: &lt;input type="password" name="user_pass"&gt;
          Password again:&lt;input type="password" name="user_pass_check"&gt;
          E-mail:&lt;input type="email" name="user_email"&gt;
          &lt;input type="submit" value="Add category"/&gt;
          &lt;/form&gt;';
      }
      else
      {
          $errors = array();/*declare the array for later use*/
          if(isset($_POST['user_name']))
          {
              //the user name exists
              if (!ctype_alnum($_POST['user_name'])) {
                  $errors[]='The username can only contain letters and digits.';
              }
  
              if(strlen($_POST['user_name'])&gt;30)
              {
                  $errors[]='The username cannot be longer than 30 characters.';
              }
          }
          else
          {
              $errors[]='The username field must not be empty.';
          }
          if(isset($_POST['user_pass']))
          {
              if($_POST['user_pass'] !=$_POST['user_pass_check'])
              {
                  $errors[]='The two passwords did not match.';
              }
          }
          else
          {
              $errors[]='The password field cannot be empty.';
          }
          if (!empty($errors))/*check for  an empty array, if there are errors, they`re in this array*/ {
              echo 'Uh-oh.. a couple of fields are not filled in correctly..';
              echo '&lt;ul&gt;';
              foreach ($errors as $key =&gt; $value)/*walk through the array so all the errors get displayed*/
               {
                  echo '&lt;li&gt;' . $value. '&lt;/li&gt;';/*This generates a nice error list*/
              }
              echo '&lt;/ul&gt;';
          }
          else
          {
              $sql = "INSERT INTO users(user_name,user_pass,user_email,user_date,user_level) VALUES('".mysqli_real_escape_string($conn,$_POST['user_name'])."',
              '".sha1($_POST['user_pass'])."',
              '".mysqli_real_escape_string($conn,$_POST['user_email'])."',
              NOW(),0)";
              $result=mysqli_query($conn,$sql);
  
              if(!$result)
              {
                  //something went wrong, display the error
  
                  echo 'Something went wrong while registering. Please try again later.';
                  //echo mysql_error(); //debugging purposes, uncomment when needed
              }
              else
              {
                  echo 'Successfully registered. You can now &lt;a href="signin.php"&gt;sign in &lt;/a&gt; and start posting! :-)';
              }
  
          }
      }
      include 'footer.php';
  ?&gt;
  </code></pre>
  
  <hr>
  
  <p>The  showed errors:</p>
  
  <blockquote>
    <p>Warning: mysqli_real_escape_string(): Couldn't fetch mysqli in
    C:\xampp\htdocs\web_forum\signup.php on line 56</p>
    
    <p>Warning: sha1() expects parameter 1 to be string, object given in
    C:\xampp\htdocs\web_forum\signup.php on line 57</p>
    
    <p>Warning: mysqli_real_escape_string(): Couldn't fetch mysqli in
    C:\xampp\htdocs\web_forum\signup.php on line 58</p>
    
    <p>Warning: mysqli_query(): Couldn't fetch mysqli in
    C:\xampp\htdocs\web_forum\signup.php on line 60</p>
  </blockquote>
  
  <p>The following code lies in line 56,57,58 and 60:</p>
  
  <pre><code>$sql = "INSERT INTO users(user_name,user_pass,user_email,user_date,user_level) VALUES('".mysqli_real_escape_string($conn,$_POST['user_name'])."',
              '".sha1($_POST['user_pass'])."',
              '".mysqli_real_escape_string($conn,$_POST['user_email'])."',
              NOW(),0)";
              $result=mysqli_query($conn,$sql);
  </code></pre>