mysqli object oriented real escape string
<p>I am new to Mysqli and PHP and want to learn to use object oriented code instead of procedural. I am struggling however to convert mysqli_real_escape_string to the object oriented way. In the code below I have used the procedural code because I don't know how to use the object oriented way and Google searches are not providing the answers I am looking for. </p>

<pre><code>$sql = "SELECT email FROM `users` WHERE email = '".mysqli_real_escape_string($link, $_POST['email'])."'LIMIT 1";

        $result = $link-&gt;query($sql);

    if($result-&gt;num_rows &gt; 0) {

        echo "The email " .$_POST['email']. " is already taken";

    } else {

        echo $_POST['email'];
    }


}
</code></pre>

<p>In the real world I would have some sort of validation on the input fields but for learning purposes for myself, I have no validation. That being said, if someone was to go to the registration page, they could use SQL injection. I am trying to prevent that in the code that checks if the email address exists. From what I have read, mysqli_real_escape_string is used to prevent SQL injection and using something like htmlspecialchars would be used to prevent XSS. I am trying to prevent SQL injection in this particular example. </p>