How to Fix Call to Undefined Function mysql_real_escape_string() Error: A Handy Guide for Web Developers

If you are a web developer, you might have come across the error message "Call to undefined function mysql_real_escape_string()" while working on your website or application. This error occurs when you try to use the deprecated function mysql_real_escape_string() in PHP 7.0 and later versions. In this guide, we will walk you through the steps to fix this error and get your website or application up and running again.

Step 1: Update Your Code

The first step to fixing this error is to update your code. As mentioned earlier, mysql_real_escape_string() is a deprecated function, and it is no longer supported in PHP 7.0 and later versions. You can replace this function with mysqli_real_escape_string() or PDO::quote() function.

Here is an example of how to use mysqli_real_escape_string() function:

$mysqli = new mysqli("localhost", "username", "password", "database_name");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Escape user inputs for security
$username = mysqli_real_escape_string($mysqli, $_POST['username']);
$password = mysqli_real_escape_string($mysqli, $_POST['password']);

// Insert query
$sql = "INSERT INTO users (username, password) VALUES ('$username', '$password')";

// Execute query
if ($mysqli->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $mysqli->error;
}

// Close connection
$mysqli->close();

Step 2: Check Your PHP Version

The next step is to check your PHP version. As mentioned earlier, mysql_real_escape_string() function is deprecated in PHP 7.0 and later versions. If you are using an older version of PHP, you can continue to use this function. However, it is recommended to update your PHP version to the latest one for security reasons.

You can check your PHP version by creating a PHP file with the following code:

<?php
echo phpversion();
?>

Save this file and run it in your web browser. It will display your PHP version.

Step 3: Use Prepared Statements

Prepared statements are another way to prevent SQL injection attacks and escape user inputs. You can use prepared statements with mysqli or PDO extension.

Here is an example of how to use prepared statements with mysqli extension:

$mysqli = new mysqli("localhost", "username", "password", "database_name");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare statement
$stmt = $mysqli->prepare("INSERT INTO users (username, password) VALUES (?, ?)");

// Bind parameters
$stmt->bind_param("ss", $username, $password);

// Escape user inputs for security
$username = $_POST['username'];
$password = $_POST['password'];

// Execute statement
if ($stmt->execute()) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $mysqli->error;
}

// Close statement and connection
$stmt->close();
$mysqli->close();

FAQ

Q1. What is mysql_real_escape_string() function?

mysql_real_escape_string() is a function in PHP that escapes special characters in a string for use in an SQL statement. It is used to prevent SQL injection attacks.

Q2. Why is mysql_real_escape_string() deprecated in PHP 7.0?

mysql_real_escape_string() function is deprecated in PHP 7.0 because it is no longer maintained and has some limitations. It is recommended to use prepared statements or other escaping functions instead.

Q3. How do I update my PHP version?

You can update your PHP version by contacting your hosting provider or following the instructions provided by your server administration panel. You can also install a local server on your computer and update PHP version there.

Q4. What is SQL injection?

SQL injection is a type of security vulnerability where an attacker can inject malicious SQL statements into a web application's database. This can lead to data theft, manipulation, or other malicious activities.

Q5. How do I prevent SQL injection attacks?

You can prevent SQL injection attacks by using prepared statements, input validation, and sanitization functions. Prepared statements are the safest way to prevent SQL injection attacks.