What are common pitfalls when using mysql_query() in PHP?

Common pitfalls when using mysql_query() in PHP include SQL injection vulnerabilities and deprecated usage of the function. To solve these issues, it is recommended to use parameterized queries with prepared statements using either mysqli or PDO extensions in PHP. 

// Example of using prepared statements with mysqli extension
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a query
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set parameters and execute
$username = "john_doe";
$stmt->execute();

// Fetch results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Process results
}

// Close statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysql_query PHP SQL injection deprecated error handling

Related Questions