title: My codes for the prevention of SQL injection isn't working, because of "$mysqli->prepare" Can anyone help me?
body: <p>My codes for the prevention of SQL injection isn't working. Can anyone help me?</p>
  
  <p><strong>I'm receiving this warning:</strong></p>
  
  <p>Notice: Undefined variable: mysqli in C:\xampp\htdocs\teknohuk\fetch_pages.php on line 18</p>
  
  <p>Fatal error: Uncaught Error: Call to a member function prepare() on null in C:\xampp\htdocs\teknohuk\fetch_pages.php:18 Stack trace: #0 {main} thrown in C:\xampp\htdocs\teknohuk\fetch_pages.php on line 18</p>
  
  <p><strong><em>Thanks.</em></strong></p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?php
  include("connection.php"); //include config file
  //sanitize post value
  
  $item_per_page = 1;
  //throw HTTP error if page number is not valid
  
  $page_number = filter_var($_POST["page"], FILTER_SANITIZE_NUMBER_INT, FILTER_FLAG_STRIP_HIGH);
  
  if(!is_numeric($page_number)){
   header('HTTP/1.1 500 Invalid page number!');
   exit();
  }
  
  //get current starting point of records
  $position = (($page_number-1) * $item_per_page);
  
  //line 17
  $results = $mysqli-&gt;prepare("SELECT id, haberAd, haberOzet, haberTarih, haberFotoURL FROM haber ORDER BY id DESC LIMIT ?, ?");//line 18
  //line19
  $results-&gt;bind_param("issss", $position, $item_per_page); 
  $results-&gt;execute(); //Execute prepared Query
  $results-&gt;bind_result($id, $haberAd, $haberOzet, $haberTarih, $haberFotoURL); //bind variables to prepared statement
  
  //output results from database
  
  while($results-&gt;fetch()){ //fetch values
   echo "&lt;div class='haber'&gt; 
      &lt;div class='haberResim'&gt;&lt;img src='img/haberler/" . $haberFotoURL . ".jpg'&gt;&lt;/div&gt;
      &lt;div class='haberYazi'&gt;&lt;div class='haberBaslik'&gt;" . $haberAd . "&lt;/div&gt;" . $haberOzet . "&lt;/div&gt;" .
      "&lt;div class='haberAciklama'&gt;&lt;div class='row'&gt;&lt;div class='block'&gt;&lt;/div&gt;&lt;/div&gt;
          &lt;div class='haberTarih'&gt;" . $haberTarih . "&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;";
  }
  ?&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
  &lt;?php
  //Connection.php
  
    $vt_sunucu          = 'localhost';
    $vt_kullanici_adi   = 'root';
    $vt_kullanici_sifre = '';
    $vt_adi             = 'gadmin';
  
  $mysqli = mysqli_connect($vt_sunucu, $vt_kullanici_adi, $vt_kullanici_sifre, $vt_adi);
  $mysqli-&gt;query("SET NAMES utf8");
  
  if (!$mysqli) {
      die("Connection failed: " . mysqli_connect_error());
  }
  ?&gt;</code></pre>
  </div>
  </div>
  </p>