mysql_real_escape_string($value) not working

Question

im trying to prevent sql injection with

mysql_real_escape_string($value)

here is my code, but it seem that i get a null value ,

$this->name_safe = mysqli_real_escape_string($this->name,$this->link);

            $this->query = "INSERT INTO student (complete_name, date_birth, gender, email, student_status)
            VALUES ( '$this->name_safe', '$this->date', '$this->gender', '$this->email_1', 'current')";

? thx

Answer 1

You have your function arguments in the wrong order. DB link comes first, then the string to escape.

http://php.net/mysqli_real_escape_string

mysqli_real_escape_string($this->link, $this->name)