1

I've just upgraded a site from CiviCRM 4.6.38 LTS to CiviCRM 5.7 because we upgraded the server to PHP 7.1.x. As a result 2, custom extensions are warning me because they used mysql_real_escape_string().

PHP 7.1.x doesn't support mysql_real_escape_string() so I need to change to mysqli_real_escape_string() and pass my mysqli data object. The issue I have is that these extensions use the old PHP/MySQL connection as in:

$dao = CRM_Core_DAO::executeQuery($sql);

Is there some documentation I can use to quickly get up to speed on updating my code and acquiring a mysqli connection object?

3

CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like mysqli_real_escape_string. You can use it in 2 ways:

  1. Parameterize your query like this:

    CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
      [1 => [$id, 'Integer']]
    );
    
  2. Escape your variables beforehand with CRM_Utils_Type::escape().

  • Thanks Coleman. I'm trying to find the docs on this. Can you point me in the right direction? – Andrew Wasson Nov 19 '18 at 21:21
  • Looks like that documentation is "still to come" docs.civicrm.org/dev/en/latest/framework/database – Coleman Nov 19 '18 at 21:41
  • 1
    Have a look at the CRM_Utils_Type::escape function to see the possible value types. – Coleman Nov 19 '18 at 21:45
  • Thanks Coleman. That's really quite useful for what I'm doing. – Andrew Wasson Nov 19 '18 at 21:56
  • 1
    Glad that worked. Note that the parameterized query in example 1 also sends the values through that same escape function. – Coleman Nov 22 '18 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.