title: Fatal error: Uncaught Error: Call to undefined function mysql_real_escape_string() in
body: <p>I am trying to escape the inputs from the login form so that to prevent sql injection. But i get and error as:</p>
  
  <blockquote>
    <p>Fatal error: Uncaught Error: Call to undefined function mysql_real_escape_string() in F:\Apache24\htdocs\Site1\user\login.php:17 Stack trace: #0 {main} thrown in F:\Apache24\htdocs\Site1\user\login.php on line 17</p>
  </blockquote>
  
  <p>I have not yet sanitized or validated user input because i am still building the page but i wanted to test if it is connecting to database properly. This is the code of the login page:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;?php 
      include('../includes/pdo_connect.php');
      $expiry = time()+60*60*24;
      if(!setcookie('userdata[user_id]', $user_id, $expiry, '', '', '', TRUE)){
          echo "&lt;script&gt;alert('could not set cookie');&lt;/script&gt;";
      }
  ?&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;title&gt;Login&lt;/title&gt;
      &lt;link rel="stylesheet" type="text/css" href="../styles/login_style.css"&gt;
      &lt;?php 
          global $con;
  
          if(isset($_POST['login_ok'])){
              $email = mysql_real_escape_string($_POST['email']);
              $pass = mysql_real_escape_string($_POST['password']);
  
              try{
                  $query = "select * from user where user_email=':email' and password=':pass'";
                  $stmt = $con-&gt;prepare();
  
                  $stmt-&gt;bindParam(':email', $email, PDO::PARAM_STR);
                  $stmt-&gt;bindParam(':pass', $pass, PDO::PARAM_STR);
  
                  $stmt-&gt;execute();
  
                  $result = $stmt-&gt;fetchAll();
  
                  foreach($result as $row) {
                      $user_id = $row['user_id'];
                      //$user_first_name = $row['user_first_name'];
                      header("Location:profile.php");
                  }
  
              } catch(PDOException $e){
                  echo "Error: ".$e-&gt;getMessage();
              }
          }
      ?&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;div class="wrapper"&gt;
          &lt;header&gt;
  
          &lt;/header&gt;
          &lt;div class="form_div"&gt;
              &lt;div class="form"&gt;
                  &lt;form id="register_form" method="post" action="" autocomplete="autocomplete"&gt;
                      &lt;table&gt;
                          &lt;tr&gt;
                              &lt;td id="label"&gt;Email: &lt;/td&gt;
                              &lt;td id="input"&gt;&lt;input type="text" name="email" required="required" id="input_box"&gt;&lt;/td&gt;
                          &lt;/tr&gt;
                              &lt;td id="label"&gt;Password: &lt;/td&gt;
                              &lt;td id="input"&gt;&lt;input type="password" name="password" id="input_box"&gt;&lt;/td&gt;
                          &lt;/tr&gt;
                          &lt;tr id="button_row"&gt;
                              &lt;td colspan="2"&gt;&lt;input type="reset" value="Reset" id="button"&gt;
                              &lt;input type="submit" value="Login" id="button" name="login_ok"&gt;&lt;/td&gt;
                          &lt;/tr&gt;
                      &lt;/table&gt;
                  &lt;/form&gt;
              &lt;/div&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>