Warning: mysqli_escape_string() expects parameter 1 to be mysqli, null given in C:\wamp64\www\form.php on line 16

Question

1.00/5 (1 vote)

See more:

Good day everyone. I was trying to submit a form to a database and on posting the form the above warning came up. Though the form was successfully posted. How do i remove the warning:

Warning: mysqli_escape_string() expects parameter 1 to be mysqli, null given in C:\wamp64\www\form.php on line 16

What I have tried:

Here is what i have tried.
<pre><?php
// the next line check for the variable POST.
	if(array_key_exists('First_Name', $_POST) OR array_key_exists('Surname', $_POST) OR array_key_exists('Address', $_POST) OR array_key_exists('Email', $_POST) OR array_key_exists('password', $_POST)){
	
		if($_POST['Email'] == ''){
			
			echo "<p> Email Address is required </p>";
		} else if($_POST['password'] == ''){
			
			echo "<p> Password is required </p>";
		}
			
		// to check if the user exist
		else{
			
			$query = "Select 'id' from 'tbl_address_book' where Email = '".mysqli_real_escape_string($link, $_POST['Email'])."'";
			$result = mysqli_query($link, $query);
			
			if(mysqli_num_rows($result) > 0){
				
				echo "<p> That Email has already been taken </p>";
			} 
			else {
				
			$query = "INSERT INTO 'tbl_address_book' ('First_Name', 'Surname', 'Address', 'Email', 'password') Values ('".mysqli_real_escape_string($link, $_POST['First_Name'])."', '".mysqli_real_escape_string($link, $_POST['Surname'])."', '".mysqli_real_escape_string($link, $_POST['address'])."', '".mysqli_real_escape_string($link, $_POST['Email'])."', '".mysqli_real_escape_string($link, $_POST['Password'])."')";
			
			
			if(mysqli_query($link, $query));
				{
					
					echo "<p> You have been successfully added to our Address Book! </p>";
				} 
				
			}
	
		}
	}
		


$link = mysqli_connect("localhost", "root", "", "addressbook");

		if(mysqli_connect_error()){
			
			die ("There was error connecting to the database");
			
		}
		
?>

Posted 29-Apr-20 8:53am

Olumideoluwatosin

Updated 4-May-20 10:42am

Add a Solution

Comments

Richard Deeming 29-Apr-20 15:05pm

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

PHP: SQL Injection - Manual[^]

Richard Deeming 29-Apr-20 15:06pm

You're storing passwords in plain text. Don't do that.
Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

PHP even has built-in functions to help you do the right thing:
PHP: password_hash[^]
PHP: password_verify[^]

Olumideoluwatosin 29-Apr-20 15:18pm

Thank you Sir. But will that stil solve the error message?

Richard Deeming 29-Apr-20 15:21pm

If you use a parameterized query, you won't need to call mysqli_real_escape_string at all, so it should resolve that error.

PHP: Prepared statements and stored procedures - Manual[^]
PHP: mysqli::prepare[^]
PHP: mysqli_stmt::bind_param[^]

Olumideoluwatosin 29-Apr-20 15:48pm

Okay, I'll get back to you asap. Thank you.

Olumideoluwatosin 4-May-20 16:43pm

Kindly find the solution i got without any error message. Thank you.

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Olumideoluwatosin · Answer 1 · 2020-05-04T10:44:00

<?php

$link = mysqli_connect("localhost", "root", "", "addressbook");

		if(mysqli_connect_error()){
			
			die ("There was error connecting to the database");
			
		}
		
		
		// the next line check for the variable POST.
	if(array_key_exists('First_Name', $_POST) OR array_key_exists('Surname', $_POST) OR array_key_exists('Address', $_POST) OR array_key_exists('Email', $_POST) OR array_key_exists('password', $_POST)){
	
	if($_POST['First_Name'] == ''){
			
			echo "<p> Your name is required </p>";
		} 
	
	else if($_POST['Surname'] == ''){
			
			echo "<p> Your Surname is required </p>";
		} 
	
		else if($_POST['Email'] == ''){
			
			echo "<p> Email Address is required </p>";
		} 
		
		else if($_POST['password'] == ''){
			
			echo "<p> Password is required </p>";
		}
		
	$First_Name = mysqli_real_escape_string($link, $_POST['First_Name']);
	$Surname = mysqli_real_escape_string($link, $_POST['Surname']);
	$Address = mysqli_real_escape_string($link, $_POST['Address']);
	$Email = mysqli_real_escape_string($link, $_POST['Email']);
	$password = mysqli_real_escape_string($link, $_POST['password']);
	
	$sql = "INSERT INTO tbl_address_book (First_Name, Surname, Address, Email, password) VALUES (?, ?, ?, ?, ?)";
	$stmt = mysqli_stmt_init($link);
	if(!mysqli_stmt_prepare($stmt, $sql)){
		
		echo "SQL Error";	
	}
	
		else{
			
			mysqli_stmt_bind_param($stmt, "sssss", $First_Name, $Surname, $Address, $Email, $password);
			mysqli_stmt_execute($stmt);
			
		}
			
	}
?>
	
		<div class="container">
		
		<form method = "post">
		
		<input type ="text" name ="First_Name" placeholder ="Your Name"><br><br>
		
		<input type ="text" name ="Surname" placeholder ="Your Surname"><br><br>
		
		<input type ="text" name ="Address" placeholder ="Your Address"><br><br>
		
		<input type ="text" name ="Email" placeholder ="Your Email"><br><br>
		
		<input type ="password" name ="password" placeholder ="Password"><br><br>
		
		<input type ="submit" value ="Sign Up">
		
		</form> 
		
	</div>

Warning: mysqli_escape_string() expects parameter 1 to be mysqli, null given in C:\wamp64\www\form.php on line 16

1 solution

Solution 1

Add your solution here

Preview 0

Warning: mysqli_escape_string() expects parameter 1 to be mysqli, null given in C:\wamp64\www\form.php on line 16

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us