mysqli_real_escape_string（）警告此代码[关闭]

Question

Query:

if ($_SERVER["REQUEST_METHOD"]=="POST") {

    $username = mysqli_real_escape_string(trim($_POST["username"]), $db);
    $password = mysqli_real_escape_string(trim($_POST["password"]), $db);
    $password = md5($password);

    $sql = "Insert into login(username,password) values('$username','$password');";
    $result = mysqli_query($db,$sql);
    echo"Successful Registration";

    if($result) {
        echo("Successfully updated");       
    }else{
        die ("no database");
    }
}

Error:

Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, string given in C:\xampp\htdocs\test.php on line 14

Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, string given in C:\xampp\htdocs\test.php on line 15

Warning: mysqli_query() expects parameter 1 to be mysqli, resource given in C:\xampp\htdocs\test.php on line 19

Successful Registrationno database

Answer 1

Your parameters are in the wrong order, read the documentation again. For example:

$username = mysqli_real_escape_string(trim($_POST["username"]), $db);

Should be:

$username = mysqli_real_escape_string($db, trim($_POST["username"]));

See http://php.net/mysqli_real_escape_string (the procedural style) for the right parameter order.