Mysqli_real_escape_string () returns an empty string

Question

I use mysqli_real_escape_string () to an email address and returns an empty string. He does this with any email address.

<?php //from previous page - submitted by user. $_POST['email']=" [e-mail] "; $_POST['password']='mypass1234'; //Link, I can verify it works. $mysql_info=array( "url"=>"url", "username"=>"username", "password"=>"password", "database"=>"database" ); $link=mysqli_connect($mysql_info['url'],$mysql_info['username'],$mysql_info['password'],$mysql_info['database']); //Now I attempt to sanitize the user input. $email=mysqli_real_escape_string($link,$_POST['email']); $password=sha1(mysqli_real_escape_string($link,$_POST['password'])); var_dump($email); var_dump($password);?> 

My collation table is "latin1_swedish_ci".

Answer 1

If your connection is empty ( $link ), it will return an empty string. I tested this and it worked fine. I would recommend that you add error handling to your connection and enable error reporting.

 <?php $link = mysqli_connect("localhost", "root", "root", "test"); /* check connection */ if (mysqli_connect_errno()) { printf("Connect failed: %s\n", mysqli_connect_error()); exit(); } $_POST['email'] = " [e-mail] "; $email = mysqli_real_escape_string($link, $_POST['email']); var_dump($email); mysqli_close($link); ?> 

Result

  string (17) " [e-mail] " 

Answer 2

I had this problem and I found that my character set is set to Latin. Solved by posting

 $con->set_charset("utf8"); 

before real_escape_string. There will be mysqli_set_charset in procedural style.