Passing variables in PHP from one file to another

So this is my code. Now how do I use $pubname in another file.

mysqli_select_db($connect,"membership");
$retname = "select username from users where email='$globalname' limit 1";
$rn = mysqli_query($connect,$retname) or die(mysqli_error($connect));
$name = mysqli_fetch_array($rn);
    //connecting for mathcing username with fullname and displaying it
$pubname = mysqli_real_escape_string($name['username']);

include('profile.php');

echo 开发者_如何转开发$pubname;

and also is this code secure? I did that...does not work yet.

---

Include the file you would like the variable to be accessible within, like so

include('somefile.php')

and at the top of that file you might need put something like [depending on server configurations]

global $pubname

But in most cases you would not need to do this.

In regards to security, depending on how $pubname is set, your query may or may not be prone to sql injection.

Note: There are other means to include() files such as include_once(), require() and require_once(), from php.net:

The documentation below also applies to require(). The two constructs are identical in every way except how they handle failure. include() produces a Warning while require() results in a Fatal Error. In other words, use require() if you want a missing file to halt processing of the page. include() does not behave this way, the script will continue regardless. Be sure to have an appropriate include_path setting as well. Be warned that parse error in required file doesn't cause processing halting in PHP versions prior to PHP 4.3.5. Since this version, it does.

---

To use $pubname in another script, keep it as global variable. You don't need to echo it. (As caveat: global variables should be used sparingly, preferrably lumped into an array.)

As far as security is concerned: You should use mysqli_real_escape_string rather on $globalname right before you use it. And escape the $pubname only right before you use that in the next query. As it looks now, you are encoding the output needlessly, but forgot to do escape the input - which _escape_string is actually meant for.

---

to use pubname in a nother file. first you have to include the file where pubname was set/created.

then use include() or require() function to call it.