php - How to upgrade from mysql_* to mysqli_*? -


i'm using deprecated code data users, follows:

/* retrieve */ $lastname = $_post['lastname'];  $firstname = $_post['firstname'];  $examlevel=$_post['level'];  /* connect */ $dbc=mysql_connect("localhost", "user", "passw") or die('error connecting mysql server'); mysql_select_db("db") or die('error selecting database.');  /* sanitize */ $lastname=mysql_real_escape_string($lastname); $firstname=mysql_real_escape_string($firstname);  $examlevel=mysql_real_escape_string($examlevel);   /* insert */ $query_personal = "insert personal (lastname, firstname) values  ('$lastname', '$firstname')";  $query_exam = "insert exam (level, centre, backupcentre, etc.) values ('$examlevel', '$centre', '$backup', 'etc')"; 

this working keep coming across warnings security , lack of support. there's small rewrite connect mysqli instead of mysql mysqli_real_escape_string? i've seen used in examples i've seen advice use prepared statements instead don't use mysqli_real_escape_string.

and how use prepared statements insert data? i'm bit @ sea bit far. example, parameter binding inserts , result binding selects?

convert pdo

/* connect */ $dsn = "mysql:host=localhost;db=test;charset=utf8"; $opt = array(     pdo::attr_errmode            => pdo::errmode_exception,     pdo::attr_default_fetch_mode => pdo::fetch_assoc ); $pdo = new pdo($dsn,"user", "passw", $opt);   /* insert */ $query = "insert personal (lastname, firstname) values  (?, ?)"; $stmt  = $pdo->prepare($query); $stmt->execute(array($_post['lastname'],$_post['firstname']));  $query = "insert exam (level, centre, backupcentre, etc) values (?, ?, ?, 'etc')"; $stmt  = $pdo->prepare($query); $stmt->execute(array($_post['level'], $centre, $backup)); 

Popular posts from this blog

How to calculate SNR of signals in MATLAB? -

c# - Attempting to upload to FTP: System.Net.WebException: System error -

ios - UISlider customization: how to properly add shadow to custom knob image -