title: How can i convert this function to prepared statment?
body: <p>I have this ajax request and it inserts data into the database without any problems but when I tried to wrap it to a prepared statement doesn't work!</p>
  
  <pre><code>$number = count($_POST["title"]);
  if($number &gt; 0)
  {
      for($i=0; $i&lt;$number; $i++)
      {
          if(trim($_POST["title"][$i] != ''))
          {
              $sql = "INSERT INTO navigations (secret_api_key, title, link) VALUES ('".$_SESSION["secret_api_key"]."', '".mysqli_real_escape_string($db, $_POST["title"][$i])."', '".mysqli_real_escape_string($db, $_POST["url"][$i])."')";
              mysqli_query($db, $sql);
          }
      }
      echo "Data Inserted";
  } else {
      echo "Enter Name";
  }
  </code></pre>
  
  <p>This is the prepared statement i tried:</p>
  
  <pre><code>$number = count($_POST["title"]);
  if($number &gt; 0)
  {
      for($i=0; $i&lt;$number; $i++)
      {
          if(trim($_POST["title"][$i] != ''))
          {
              $sql = $db-&gt;prepare("INSERT INTO navigations (secret_api_key, title, link) VALUES (?, ?, ?)");
              $sql-&gt;bind_param("sss", '.$_SESSION["secret_api_key"].", ".$_POST["title"][$i].", ".$_POST["url"][$i]."');
              $sql-&gt;execute();
          }
      }
      echo "Data Inserted";
  } else {
      echo "Enter Name";
  }
  </code></pre>
  
  <p>maybe it will be solved if ".mysqli_real_escape_string($db, $_POST["url"][$i])." converted</p>