mysql_* Functions — Why They Were Removed

Also Known As

TL;DR

Explanation

The mysql extension provided functions like mysql_connect(), mysql_query(), mysql_fetch_array(), and mysql_real_escape_string(). It had two critical problems: no prepared statements, and mysql_real_escape_string() could be bypassed in certain character sets. The mysqli extension added prepared statements in PHP 5, and PDO added a clean multi-database API. mysql_* was deprecated in PHP 5.5 and removed in PHP 7.0. Any codebase still using it cannot run on PHP 7+.

Common Misconception

Why It Matters

Common Mistakes

• Using mysql_real_escape_string() believing it prevents all SQL injection
• Migrating to PHP 7 without replacing mysql_* calls (they will fatal error)
• Copy-pasting mysql_* examples from old Stack Overflow answers

Code Examples

// mysql_ extension — removed in PHP 7:
$conn = mysql_connect('localhost', 'root', '');
$result = mysql_query('SELECT * FROM users');
while ($row = mysql_fetch_array($result)) {
    echo $row['name'];
}

// PDO — works across MySQL, PostgreSQL, SQLite:
$pdo = new PDO('mysql:host=localhost;dbname=app', 'user', 'pass');
$stmt = $pdo->prepare('SELECT * FROM users WHERE active = ?');
$stmt->execute([1]);
foreach ($stmt->fetchAll() as $row) {
    echo htmlspecialchars($row['name']);
}

References

• ↗ https://www.php.net/manual/en/migration70.removed-exts-sapis.php

Tags

Related Terms