prevent sql injection in mysqli
<p>I am very new to mysqli earlier i am writing queries in mysql but mysqli is more advanced so, i am first time using it.
Below is my php code. </p>

<pre><code>    function clean($str) {
        $str = @trim($str);
        if(get_magic_quotes_gpc()) {
            $str = stripslashes($str);
        }
        return mysql_real_escape_string($str);
    }

        $email = clean($_POST['email']);
        $password = clean($_POST['password']);
        //$password =md5($password);


    if(empty($res['errors'])) {
        $result = $mysqli-&gt;query("SELECT uid FROM users where email='$email' and password = '$password'");
        if($result-&gt;num_rows == 1){
            $res['success'] = true;
        }
        else{
            array_push($res['errors'], 'Invalid login details');
            $res['success'] = false;

        }
    }else{
        $res['success'] = false;        
    }
    echo json_encode($res);
}
</code></pre>

<p>clean function is not working as expected because sql queries return false if i enter username and password correct.
So, it seems like this is not valid in mysqli case.</p>

<p>I checked this link <a href="https://stackoverflow.com/questions/16282103/php-mysqli-prevent-sql-injection">PHP MySQLI Prevent SQL Injection</a> and got to know that we have to prepare query. </p>

<p>I can see there is an example but i am not able to understand how to prepare/bind if i have to use two or more form data.</p>

<p>Thanks for your time.</p>

<p><strong>Updated code</strong></p>

<pre><code>$result = $mysqli-&gt;prepare("SELECT uid FROM users where email=:email and password = :password");
        $result-&gt;execute([
':email' =&gt; $email,
         ':password' =&gt; $password]);
        //$result-&gt;execute();
        if($result-&gt;num_rows == 1){
        //if(mysqli_num_rows($result) === 1) {
            $res['success'] = true;

        }
        else{
            array_push($res['errors'], 'Invalid login details');
            $res['success'] = false;

        }
</code></pre>