Using MySQL_real_escape_string to process form data

Current Location：Home > Learning > DATABASE > MySQL >

Using MySQL_real_escape_string to process form data

Author：JIYIK Last Updated：2025/04/22 Views：

This article will teach you how to use mysqli_real_escape_stringto process form data.

First, we will set up a sample database and a table. Then we will create an HTML form that accepts user input.

After that, in PHP, we will explain how to use mysqli_real_escape_stringwithout causing errors.

Setting up a local server

All the code for this article will be run on a server. Therefore, if you have access to a live server, you can skip this section and proceed to the next one.

If you don't have one, install a local server such as XAMPP from Apache Friends. Once XAMPP is installed, find htdocsthe folder and create one.

This folder will store all the code for this article.

Create database and table

In XAMPP, you can phpMyAdmincreate a database using either or the command line. If you are on the command line, log into MySQL using the following command:

#login to mysql
mysql -u root -p

After logging into MySQL, create a database. In this article, we will refer to the database as my_details.

CREATE database my_details

After creating the database, create a table using the next SQL code. This table will hold the data for our sample project.

CREATE TABLE bio_data (
id INT NOT NULL AUTO_INCREMENT,
first_name VARCHAR(50) NOT NULL,
last_name VARCHAR(50) NOT NULL,
PRIMARY KEY (id)) ENGINE = InnoDB;

Creating the HTML Form

The HTML form will have two form inputs. The first collects the user's first name, and the second collects the last name.

<head>
    <meta charset="utf-8">
    <title>Process Form With mysqli_real_escape_string</title>
    <style>
        body {
            display: grid;
            justify-content: center;
            align-items: center;
            height: 100vh;
        }
    </style>
</head>
<body>
    <main>
        <form action="process_form.php" method="post">
            <label id="first_name">First Name</label>
            <input id="first_name" type="text" name="first_name" required>
            <label id="last_name">Last Name</label>
            <input id="last_name" type="text" name="last_name" required>
            <input type="submit" name="submit_form" value="Submit Form">
        </form>
    </main>
</body>

Output:

Processing tabular data

During form processing, we use mysqli_real_escape_stringto escape form input. More importantly, the database connection should be mysqli_real_escape_stringthe first argument to .

So we used below on first and last name mysqli_real_escape_string. To use this code, save it as process_form.php.

<?php
    if (isset($_POST['submit_form']) && isset($_POST["first_name"]) && isset($_POST["last_name"])) {
        // Set up a database connection.
        // Here, our password is empty
        $connection_string = new mysqli("localhost", "root", "", "my_details");

        // Escape the first name and last name using
        // mysqli_real_escape_string function. Meanwhile,
        // the first parameter to the function should
        // be the database connection. If you omit, the
        // database connection, you'll get an error.
        $first_name = mysqli_real_escape_string($connection_string, trim(htmlentities($_POST['first_name'])));
        $last_name = mysqli_real_escape_string($connection_string, trim(htmlentities($_POST['last_name'])));

        // If there is a connection error, notify
        // the user, and Kill the script.
        if ($connection_string->connect_error) {
            echo "Failed to connect to Database. Please, check your connection details.";
            exit();
        }

        // Check string length, empty strings and
        // non-alphanumeric characters.
         if ( $first_name === "" || !ctype_alnum($first_name) ||
                strlen($first_name) <= 3
            ) {
                echo "Your first name is invalid.";
                exit();
        }

         if ( $last_name === "" || !ctype_alnum($last_name) ||
                strlen($last_name) < 2
            ) {
                echo "Your last name is invalid.";
                exit();
        }

        // Insert the record into the database
        $query = "INSERT into bio_data (first_name, last_name) VALUES ('$first_name', '$last_name')";
        $stmt = $connection_string->prepare($query);
        $stmt->execute();

        if ($stmt->affected_rows === 1) {
            echo "Data inserted successfully";
        }
    } else {
        // User manipulated the HTML form or accessed
        // the script directly. Kill the script.
        echo "An unexpected error occurred. Please, try again later.";
        exit();
    }
?>

Output (if successful):

`Mysqli_real_escape_string`Cause of error in

If you mysqli_real_escape_stringomit the database connection in , you will get an error message. So, in the following code, we modified it process_form.php.

Also, this version does not have mysqli_real_escape_stringa database connection in . Therefore, you will get an error when you want to insert data into the database.

<?php
    if (isset($_POST['submit_form']) && isset($_POST["first_name"]) && isset($_POST["last_name"])) {
        $connection_string = new mysqli("localhost", "root", "", "my_details");

        // We've omitted the connection string
        $first_name = mysqli_real_escape_string(trim(htmlentities($_POST['first_name'])));
        $last_name = mysqli_real_escape_string(trim(htmlentities($_POST['last_name'])));

        if ($connection_string->connect_error) {
            echo "Failed to connect to Database. Please, check your connection details.";
            exit();
        }
        if ( $first_name === "" || !ctype_alnum($first_name) ||
                strlen($first_name) <= 3
           ) {
            echo "Your first name is invalid.";
            exit();
        }

         if ( $last_name === "" || !ctype_alnum($last_name) ||
                strlen($last_name) < 2
            ) {
                echo "Your last name is invalid.";
                exit();
        }

        $query = "INSERT into bio_data (first_name, last_name) VALUES ('$first_name', '$last_name')";
        $stmt = $connection_string->prepare($query);
        $stmt->execute();

        if ($stmt->affected_rows === 1) {
            echo "Data inserted successfully";
        }
    } else {
        echo "An unexpected error occurred. Please, try again later.";
        exit();
    }
?>

Example error message:

Fatal error: Uncaught ArgumentCountError: mysqli_real_escape_string() expects exactly 2 arguments, 1 given in C:\xampp\htdocs\processformmysqli\process_form.php:12 Stack trace: #0 C:\xampp\htdocs\processformmysqli\process_form.php(12): mysqli_real_escape_string('Johnson') #1 {main} thrown in C:\xampp\htdocs\processformmysqli\process_form.php on line 12

Previous：Enforce case sensitivity in MySQL LIKE

Next：Grouping by multiple columns in MySQL

For reprinting, please send an email to 1244347461@qq.com for approval. After obtaining the author's consent, kindly include the source as a link.

Article URL：

JIYIK CN >