title: Why does mysqli_real_escape_string() require two params?
body: <p>Could someone explain this to me please.</p>
  
  <p>Let's take a look at this script.</p>
  
  <pre><code>&lt;?php
  $con=mysqli_connect("localhost","my_user","my_password","my_db");
  
  // Check connection
  if (mysqli_connect_errno()) {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
  
  // escape variables for security
  
  $firstname = mysqli_real_escape_string($con, $_POST['firstname']);
  $lastname = mysqli_real_escape_string($con, $_POST['lastname']);
  $age = mysqli_real_escape_string($con, $_POST['age']);
  
  $sql="INSERT INTO Persons (FirstName, LastName, Age)
  VALUES ('$firstname', '$lastname', '$age')";
  
  if (!mysqli_query($con,$sql)) {
    die('Error: ' . mysqli_error($con));
  }
  echo "1 record added";
  
  mysqli_close($con);
  ?&gt;
  </code></pre>
  
  <p>If the job of <code>mysqli_real_escape_string()</code> is to escape characters in a string, why does it need the connection along with it, if it's already within the script above?
  Not forgetting the fact that <code>mysqli_real_escape_string()</code> escapes characters from a variable of some kind value and not from database.</p>
  
  <p>And if it was from a database, it would only make sense to even use it if the same exact data was to be re-insterted back into a database, would it not?</p>