How can the use of deprecated functions like `mysql_query` and `mysql_real_escape_string` impact the security of a PHP application?

The use of deprecated functions like `mysql_query` and `mysql_real_escape_string` can impact the security of a PHP application by making it vulnerable to SQL injection attacks. To address this issue, it is recommended to switch to using the mysqli or PDO extension for database operations and prepared statements for secure parameterized queries. 

// Connect to MySQL using mysqli
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Use prepared statements to prevent SQL injection
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set parameters and execute
$username = "john_doe";
$stmt->execute();

// Process the result
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Do something with the data
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

deprecated functions mysql_query mysql_real_escape_string security impact PHP application

Related Questions