What are the common pitfalls when using the mysql_query function in PHP?

Common pitfalls when using the mysql_query function in PHP include vulnerability to SQL injection attacks and deprecated usage of the function. To prevent SQL injection, it is recommended to use prepared statements or parameterized queries instead. Additionally, since the mysql_query function is deprecated in newer versions of PHP, it is advisable to use MySQLi or PDO for database interactions. 

// Using prepared statements to prevent SQL injection
$conn = new mysqli($servername, $username, $password, $dbname);
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();

// Using MySQLi or PDO instead of mysql_query
$conn = new mysqli($servername, $username, $password, $dbname);
$result = $conn->query("SELECT * FROM users");

Keywords

mysql_query PHP SQL injection deprecated security vulnerability

Related Questions