Question

I want to implement a short-cut function to replace the commonly used mysqli_real_escape_string() as follow in a separate script that will be included to my main script:

 $cxn = mysqli_connect($hostname, $username, $password, $databasename) 
  or die ("Couldn't connect to server.");

 function m($str) {return "'".mysqli_real_escape_string($cxn, $str)."'";}

The main script contains foreach that will loop through the array as follows:

 foreach($ARRAY as $field => $value)
 {
  $fields[] = $field;
  $value = strip_tags(trim($value));
  $values[] = m($value); // function m() is implemented here
 }

Upon inspecting the SQL statement, I find that all the inserted values are empty. I know that if no connection is open, mysqli_real_escape_string() will return an empty string, so this could be the problem. However, if I were to replace the following line

$values[] = m($value);

with this,

$values[] = "'".mysqli_real_escape_string($cxn, $value)."'";

all the proper values are returned. So, what could be the reason causing my short-cut function m() to fail?

Answer 1

$cxn = mysqli_connect();
function e($string)
{
    global $cxn;
    return mysqli_real_escape_string($string, $cxn);
}