What best practices should be followed when using the mysql_query() function in PHP to prevent errors?

When using the mysql_query() function in PHP, it is important to sanitize user input to prevent SQL injection attacks. This can be done by using prepared statements or escaping input using functions like mysqli_real_escape_string(). Additionally, error handling should be implemented to catch and handle any potential errors that may occur during the query execution. 

// Example of using mysqli_real_escape_string() to sanitize user input before using mysql_query()

// Establish a connection to the database
$connection = mysqli_connect("localhost", "username", "password", "database");

// Check if the connection was successful
if (!$connection) {
    die("Connection failed: " . mysqli_connect_error());
}

// Sanitize user input
$user_input = mysqli_real_escape_string($connection, $_POST['user_input']);

// Execute the query
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($connection, $query);

// Check if the query was successful
if ($result) {
    // Process the results
} else {
    // Handle the error
    echo "Error: " . mysqli_error($connection);
}

// Close the connection
mysqli_close($connection);

Keywords

mysql_query PHP SQL injection error handling data validation

Related Questions