试图解决mysqli_real_escape_string错误

Question

我尝试使用此函数停止SQL_injection。但我不知道为什么我会得到这个错误？

define('DB_HOST', 'localhost'); 
define('DB_USER', 'root'); 
define('DB_PASSWORD', ''); 
define('DB_DATABASE', 'cms'); 

$link = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE); 
if (mysqli_connect_errno()){ 
    echo "Failed to connect to MySQL: " . mysqli_connect_error(); 
} 
mysqli_query($link, "SET NAMES 'utf8';"); 

function clean($str) { 
$str = @trim($str); 
if(get_magic_quotes_gpc()) { 
    $str = stripslashes($str); 
} 
return mysqli_real_escape_string($link, $str); 
} 

$SmjestajGPS = clean($_POST['SmjestajGPS']); 

我得到这个错误：

Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, null given in /home/ninpriva/public_html/admin/smjestaj-obrada.php on line 17 
OK 

但是，当我走这条路我没有错误：

$SmjestajGPS = mysqli_real_escape_string($link, $_POST['SmjestajGPS']); 

Answer 1

清洁应该被改写成这样：

function clean($link, $str) { 
    $str = trim($str); 
    if (get_magic_quotes_gpc()) { 
     $str = stripslashes($str); 
    } 
    return mysqli_real_escape_string($link, $str); 
} 

$SmjestajGPS = clean($link, $_POST['SmjestajGPS']);