use the method in a query
THIS IS NOT THE RECOMMENDED METHOD!
$db->query('
SELECT
*
FROM
users
WHERE
gender = "' . $db->escape($gender) . '"
');
the recommended method
(variable are automatically escaped this way)
$db->query('
SELECT
*
FROM
users
WHERE
gender = ?
', array($gender));
function escape($string)
{
// if an active connection exists
if ($this->_connected()) {
// if "magic quotes" are on, strip slashes
if (get_magic_quotes_gpc()) {
$string = stripslashes($string);
}
// escape and return the string
return mysqli_real_escape_string($this->connection, $string);
}
// upon error, we don't have to report anything as _connected() method already did
// just return FALSE
return false;
}