What are the recommended alternatives to using mysql_* functions in PHP for improved security and performance?

The recommended alternatives to using mysql_* functions in PHP for improved security and performance are using either MySQLi (MySQL Improved) or PDO (PHP Data Objects) extensions. These alternatives provide prepared statements to prevent SQL injection attacks and support parameter binding for better performance. 

// Using MySQLi extension
$mysqli = new mysqli('localhost', 'username', 'password', 'database');

if ($mysqli->connect_error) {
    die('Connection failed: ' . $mysqli->connect_error);
}

$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$username = 'john_doe';
$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // Process the fetched data
}

$stmt->close();
$mysqli->close();

Keywords

mysqli PDO prepared statements SQL injection performance optimization

Related Questions