title: mysqli_real_string_escape failing with GET
body: <p>I have a static database connection established in a file which I include as</p>
  
  <pre><code>include_once 'database.inc.php';
  </code></pre>
  
  <p>named <code>$mysqli</code>.</p>
  
  <p>When I pass a parameter <code>$tbname</code> from a form using <code>$tbname = $_GET['tbname']</code>, and attempt to use <code>$tbname = $mysqli-&gt;real_esacpe_string($tbname)</code>, it produces identical output to $tbname, including when invalid characters such as <code>/,'"</code> are used in the name.</p>
  
  <p>Based on looking at other questions and proper usage, I cannot find a reason why the string escape should fail. It also fails if a procedural call is used to <code>mysqli_real_escape_string($mysqli, $tbname)</code>.</p>
  
  <p>When <code>$tbname</code> is valid and not string escaped by the function, my query</p>
  
  <pre><code>query = $mysqli-&gt;prepare("CREATE TABLE $tbname (ID INT NOT NULL AUTO_INCREMENT PRIMARY KEY)") or trigger_error($mysqli-&gt;error."[$query]");
  </code></pre>
  
  <p>works as intended.</p>