I have this code i use to connect to the database and get thing from it secure, How can I make more secure?? class db {    // The database connection    protected static $connection;    /**     * Connect to the database     *      * @return bool false on failure / mysqli MySQLi object instance on success     */    protected function connect() {            // Try and connect to the database        if(!isset(self::$connection)) {            // Load configuration there are defined in config.php            require_once('app/config/config.php');            self::$connection = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_DBNAME);        }        // If connection was not successful, handle the error        if(self::$connection === false) {            // Handle error - notify administrator, log to a file, show an error screen, etc.            return false;        }        return self::$connection;    }    /*        Query the database        @param $query The query string        @return mixed The result of the mysqli::query() function    */    private function query($query) {        // Connect to the database        $connection = $this->connect();        // Query the database        $result = $connection->query($query);        return $result;    }    /*        Fetch rows from the database (SELECT query)        @param $query The query string        @return bool False on failure / array Database rows on success    */    public function select($query) {        $result = $this->query($query);        if($result === false) {            return false;        }        $rows = array();        while ($row = $result->fetch_assoc()) {            $rows[] = $row;        }        return $rows;     }}When I want infomation from the DBExample:$db = new db();$result = $db->select(SELECT * FROM users WHERE name = John);
Secure database connection in PHP
php;mysqli;securestring
You're asking the wrong question. The right question is What should I use instead of query? The answer is that if you want to reinvent the wheel, you should use prepared statements, and if you don't then you should use an ORM which uses prepared statements under the hood. Prepared statements allow you to pass in parameters and ensure that the escaping is done correctly. E.g. you would use SELECT * FROM foo WHERE bar = ? passing parameter baz rather than SELECT * FROM foo WHERE bar =  . mysqli_real_escape_string(baz).