As per the documentation, you are using the variant which requires a connection variable to be passed as an argument:
string mysqli_real_escape_string ( mysqli $link , string $escapestr )
The object-oriented style (with one parameter) is performed on a connection variable thus (from the same page linked to above):
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
$city = $mysqli->real_escape_string($city);