What are the best practices for transitioning from mysql_* functions to mysqli_* or PDO in PHP for improved code quality and security?

When transitioning from mysql_* functions to mysqli_* or PDO in PHP, it is important to update your code to use prepared statements to prevent SQL injection attacks and improve code quality. Prepared statements separate SQL logic from data, making it safer to interact with databases. Additionally, mysqli_* and PDO offer better support for modern MySQL features and better error handling. 

// Using mysqli prepared statements to prevent SQL injection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL statement
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set parameters and execute
$username = "john_doe";
$stmt->execute();

// Bind result variables
$stmt->bind_result($user_id, $username, $email);

// Fetch results
while ($stmt->fetch()) {
    echo "User ID: " . $user_id . " Username: " . $username . " Email: " . $email . "<br>";
}

// Close statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysql_ functions mysqli_ PDO code quality security

Related Questions