Why shouldn’t we use mysql_* functions?

Question

A very common question is why should we stop using mysql_* functions? For example mysql_query(), or mysql_connect().

I see that many people use them, or stop using them but do not know the real reason. Why they should stop being used once they work?

Answer 1

Summary

The answer is only one: we should not use functions of the extension "mysql" because its development has been discontinued; the extension became obsolete, that is to say, code that uses these functions will not work in future versions of PHP.

---

Details

A user of the Stack Overflow site wrote:

There is no security problem with library itself but rather with library users (there are no security issues with the library itself, but rather with library users).

The vote to discontinue (deprecate) or not, resulted in 25 votes in favour and 12 votes against. It was a good majority, but it was not a unanimous decision. See the official source.

In the same font, another developer wrote:

The Extension is not Broken. The problem is the bad Usage. It can be used Safely, and good Developers have been Doing so for ages (The extension has no defects. The problem is misuse. It can be used safely, and good developers have been doing it for years).

The citation below, also from the same official document, points to the real reasons to discontinue the extension:

ext/mysql is hard to maintain code. It is not Getting new Features. Keeping it up to date for Working with new versions of libmysql or mysqlnd versions is work, we probably could Spend that time Better.

(The mysql extension contains hard-to-maintain code. It is not receiving new "Features". Keep it updated to work with new versions of libmysqld and mysqlnd is laborious; we could be using better this time.)

In other words: "So I have a hard time keeping this old code?" - as far as new versions of Mysql (and their "client libs") are released, the extension needs to be updated...

...and, in addition, extensions already exist mysqli (more modern) and the alternative PDO... So... why keep going? Let’s discontinue? Then, 25 voted "yes", 12 voted "no", and the decision was made.

---

Personal Comment

When I started with PHP there was no PDO extension. I used the "mysql" extension, like most, until I worked on a project using "mysqli" and became aware of the advantages, and always preferred the same since then.

Soon after, I wrote a couple of classes that extend the original extension mysqli, and I use them today in pure PHP, that is, when I’m not using a framework as the Laravel, with its "Fluent" and its "Eloquent", the Symfony with "Doctrine", etc...

For me, accustomed even to the little details of preparing "LIKE" clauses to attack-proof, the "black box" of these "Prepared statements", "Active Record" or "ORM" was viewed with suspicion. That phase passed, and today I’m a fan of the Eloquent that comes with the Laravel 4...

---

Addendum

After publishing the entire answer above, I felt the need to stress the importance of the factor "not Getting new Features" in the decision to discontinue the extension. That is to say, although it is the fastest (best performance) in the execution of simple tasks, it lacks the full range of functionalities that the alternative extensions (mysqli and PDO) contain (transactions, SSL support, etc.) - point that was highlighted in other responses here.

Answer 2

Because the use of functions mysql_* was frowned upon (deprecated) from PHP 5.5 and, according to the documentation, functions will be removed in future versions of PHP, causing the programs that use them to stop working in those versions.

Limitations of functions mysql_*

Unlike the functions of mysqli_*, the functions mysql_* do not support

• asynchronous, non-blocking queries
• parameterized consultations
• stored procedures
• transactions

Lack of support for parameterized queries means that when using functions mysql_* without taking certain precautions, your program is vulnerable to SQL injection attacks, compromising data security and integrity. Example:

// consulta vulnerável a injeção de SQL
$query = mysql_query("SELECT * FROM alunos WHERE id = $id")

// consulta parametrizada, variável $id é higienizada
$query = mysqli_query("SELECT * FROM alunos WHERE id = ?")
$query->bind_param("i", $id);

Alternatives

Alternatively, it is recommended to use functions mysqli_*, beyond the already mentioned limitations of the functions mysql_*.

Another option is to use PDO (PHP Data Objects) which provides an abstraction layer of data access, which means that regardless of which database you are using, you can use the same functions to send queries and fetch data.

History

To learn the story behind the disapproval of functions mysql_*, see the reply from J.Bruni.

Answer 3

We should no longer use mysql_* for the following reason:

INSERT INTO usuarios SET nome='$nome';

The value is passed directly into the sql clause, this leaves the application vulnerable to sql Injection attacks. With Pdo:

$con->prepare("INSERT INTO usuarios SET nome=?");
$con->bindParam(1, $nome);
$con->execute();

When using Pdo the query is prepared, passing through a layer of protection, layer that mysql_* does not have, at the time of replacing the values, this layer of protection goes into action checking if the command is similar to sql Injection.

Answer 4

For a simple reason is enough for many:

This Mysql extension has been discontinued by the PHP development team. But then you ask me, why was it discontinued since it was simple and worked cool? I tell you what: As PHP is increasingly object-oriented and this Mysql extension was created for structured PHP, it started to show flaws in the object-oriented environment. Does not support Stored Procedure. Does not support transactions. Only works with Mysql up to 5.0. ... Among others. See a comparison here

Then a code with mysql methods will have a deficit in the future to support new implementations and to fix future bugs. Use PHP PDO.

Answer 5

We see that we have many answers about this, but in short, anything that the latest version in PHP (or any language) goes into the obsolete state, we should change, try to adapt the code and if possible use newer features that may become standard in the future and PDO is an example. Unfortunately there are programmers who ignore this and will only learn and make the corrections when some migration to a server or something like that starts to accuse the error. Anyway, change needed, sooner or later would need to be done and fortunately from here a time use PDO or Mysqli will be like making a mysql_*

Answer 6

Guys, for educational purposes only, I’m posting a table containing some important information about mysql, mysqli and PDO.