How can outdated PHP functions like mysql_real_escape_string be replaced for security purposes?

To replace outdated PHP functions like mysql_real_escape_string for security purposes, you can switch to using parameterized queries with PDO or MySQLi. This approach separates the SQL query from the user input, preventing SQL injection attacks. By binding parameters to the query, you ensure that user input is properly sanitized and escaped. 

// Using PDO for secure database operations
$db = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a statement with placeholders
$stmt = $db->prepare("SELECT * FROM users WHERE username = :username");

// Bind the parameter
$stmt->bindParam(':username', $username);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

PHP mysql_real_escape_string security mysqli_real_escape_string prepared statements

Related Questions