What are the potential pitfalls of using mysql_db_query and "SELECT *" in PHP code?

Using mysql_db_query and "SELECT *" in PHP code can lead to security vulnerabilities and inefficient code. It is recommended to use mysqli or PDO functions for database queries to prevent SQL injection attacks. Additionally, it is best practice to specify the columns you want to select rather than using "SELECT *" to improve performance and avoid potential issues with changes in the database structure. 

// Connect to the database using mysqli
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Specify the columns you want to select instead of using "SELECT *"
$sql = "SELECT column1, column2 FROM table_name";

$result = $mysqli->query($sql);

if ($result->num_rows > 0) {
    // Output data
    while($row = $result->fetch_assoc()) {
        echo "Column1: " . $row["column1"]. " - Column2: " . $row["column2"]. "<br>";
    }
} else {
    echo "0 results";
}

$mysqli->close();

Keywords

mysql_db_query SELECT * security vulnerability SQL injection deprecated function

Related Questions