What are the potential security risks associated with using mysql_* functions in PHP and what alternatives should be considered?

Using mysql_* functions in PHP can lead to security vulnerabilities such as SQL injection attacks. It is recommended to use mysqli or PDO instead, as they provide prepared statements and parameterized queries to prevent SQL injection. 

// Using mysqli prepared statements to prevent SQL injection

$mysqli = new mysqli("localhost", "username", "password", "database");

if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = "admin";
$stmt->execute();

$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // process results
}

$stmt->close();
$mysqli->close();

Keywords

mysql_* functions security risks alternatives PHP SQL injection

Related Questions