What are the advantages and disadvantages of combining mysql_query() with mysql_fetch_*() or mysql_result() functions in PHP?

When combining `mysql_query()` with `mysql_fetch_*()` or `mysql_result()` functions in PHP, the advantage is that it allows for more flexibility in fetching and processing data from a MySQL database. However, this approach is not recommended due to security risks associated with SQL injection vulnerabilities. It is better to use prepared statements or parameterized queries to prevent these security risks. 

// Example of using prepared statements with mysqli instead of mysql_query() and mysql_fetch_*()

// Establish a connection to the database
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check for connection errors
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a statement
$stmt = $mysqli->prepare("SELECT id, name FROM users WHERE id = ?");
$id = 1;
$stmt->bind_param("i", $id);

// Execute the statement
$stmt->execute();

// Bind the result variables
$stmt->bind_result($id, $name);

// Fetch the results
while ($stmt->fetch()) {
    echo "ID: $id, Name: $name <br>";
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysql_query mysql_fetch mysql_result advantages disadvantages

Related Questions