That’s an OOP class property. Accessing it inside of an instance of its class would use $this->link. To access it outside of an instance of its class, which is where the mysqli_real_escape_string call is at, would require knowing what variable is holding the instance of that class.
Also, these type of database class ‘wrappers’ are usually just a bunch of code for nothing, that don’t help simplify writing applications.
At this point, it would take having all the relevant code in order to help you. It may be that the amount of changes, beyond fixing the current error, to make this work, is much more than to simply rewrite the database code using best practices.
BTW - using mysqli_real_escape_string only provides protection for string data types and only if you have set the character set that php is using to match your database tables (this point is mentioned in the ‘caution’ statement in the mysqli_real_escape_string documentation.) It provides no protection for numerical data types. The best method for providing protection for all data types is to use prepared queries, which actually simplifies converting old code, because it eliminates the need to use escape string functions and it simplifies the sql query syntax. Unfortunately, prepared queries using the mysqli extension are overly complicated and require you to essentially learn two different sets of statements. It is better and much simpler to convert code to use the PDO database extension instead.