How to Secure PHP Script: Instructors and Students Guide

[Kyran]

I find it hard to see that most of the programmers here who uploaded their source code are still using the old fashion way of connecting to MySQL database using PHP script.

The majority of these programmers are students. I believe that these students are just following on what they have learned from their instructor.

If you have noticed, the connection used is still the old mysql extension and not mysqli. "I" in the mysqli stands for "improved". Starting in version 4.1.3 of MySQL, PHP are using mysqli extension. It was developed to take advantage of the new features found in MySQL.

Mysqli can be either used as procedural or object oriented (OOP). If you have lots of PHP script and would like to use the new standard, I suggest that you use the procedural approach. It is easier to convert mysql to mysqli, that’s the main reason why we need to use this kind of approach.

Here’s an example:

mysql_connect:

$con

=

mysql_connect

(

'localhost'

,

'root'

,

'password'

,

'database'

)

;

Converting to mysqli using procedural approach:

$con

=

mysqli_connect

(

'localhost'

,

'root'

,

'password'

,

'database'

)

;

Converting to mysqli using OOP approach:

$con

=

new

mysqli(

'localhost'

,

'root'

,

'password'

,

'database'

)

;

Now you see the difference?

In procedural approach, you just change the mysql_connect to mysqli_connect.

The same thing will happen also on other functions like:

mysql_query = mysqli_query
mysql_fetch_assoc = mysqli_fetch_assoc

In fact, the old mysql extension is now depreciated in version 5.5.0 of MySQL. This means that your script will not work anymore in the newest version of MySQL.