whats wrong with this php mysql_real_escape_string
<p><pre></p>


<br />

Atomic Number
Latin
English
Abbreviation




<p>* check the variables for content */</p>

<code>/*** a list of filters ***/
$filters = array(
'searchtext' =&gt; array( 'filter' =&gt; FILTER_CALLBACK, 'options'  =&gt; 'mysql_real_escape_string'),
'fieldname'  =&gt; array( 'filter' =&gt; FILTER_CALLBACK, 'options'  =&gt; 'mysql_real_escape_string')
);

/*** escape all POST variables ***/
$input = filter_input_array(INPUT_POST, $filters);

/*** check the values are not empty ***/
if(empty($input['fieldname']) || empty($input['searchtext']))
    {
    echo 'Invalid search';
    }
else
    {
    /*** mysql hostname ***/
    $hostname = 'localhost';

    /*** mysql username ***/
    $username = 'username';

    /*** mysql password ***/
    $password = 'password';

    /*** mysql database name ***/
    $dbname = 'periodic_table';

    /*** connect to the database ***/
    $link = @mysql_connect($hostname, $username, $password);

    /*** check if the link is a valid resource ***/
    if(is_resource($link))
        {
        /*** select the database we wish to use ***/
        if(mysql_select_db($dbname, $link) === TRUE)
            {
            /*** sql to SELECT information***/
        $sql = sprintf("SELECT * FROM elements WHERE %s = '%s'", $input['fieldname'], $input['searchtext']);

        /*** echo the sql query ***/
        echo '&lt;h3&gt;'.$sql.'&lt;/h3&gt;';

            /*** run the query ***/
            $result = mysql_query($sql);

            /*** check if the result is a valid resource ***/
            if(is_resource($result))
                {
                /*** check if we have more than zero rows ***/
                if(mysql_num_rows($result) !== 0)
                    {
            echo '&lt;table&gt;';
                    while($row=mysql_fetch_array($result))
                        {
                        echo '&lt;tr&gt;
                        &lt;td&gt;'.$row['atomicnumber'].'&lt;/td&gt;
                        &lt;td&gt;'.$row['latin'].'&lt;/td&gt;
                        &lt;td&gt;'.$row['english'].'&lt;/td&gt;
                        &lt;td&gt;'.$row['abbr'].'&lt;/td&gt;
                        &lt;/tr&gt;';
                        }
            echo '&lt;/table&gt;';
                    }
                else
                    {
                    /*** if zero results are found.. ***/
                    echo 'Zero results found';
                    }
                }
            else
                {
                /*** if the resource is not valid ***/
                'No valid resource found';
                }
            }
        /*** if we are unable to select the database show an error ****/
        else
            {
            echo 'Unable to select database '.$dbname;
            }
        /*** close the connection ***/
        mysql_close($link);
        }
    else
        {
        /*** if we fail to connect ***/
        echo 'Unable to connect';
        }
    }
}
</code></pre>

<p>else
    {
    echo 'Please Choose An Element';
    }
?>
</p>

<p>I got this code from phppro.org tutorials site and i tried to run it. It gives 
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established. ....
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'ODBC'@'localhost' (using password: NO)....</p>

<p>I went to php.net and look it up "Note: A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE  is returned. If link_identifier  isn't defined, the last MySQL connection is used."</p>

<p>My questions are:
1-why they put  single quotation around mysql_real_escape_string ?
2-They should establish a connection first, then use the $filter array statement with mysql_real_escape_string ?</p>
