Upgrading Custom Extension for PHP 7: How to I instantiate a mysqli data object

Question

I've just upgraded a site from CiviCRM 4.6.38 LTS to CiviCRM 5.7 because we upgraded the server to PHP 7.1.x. As a result 2, custom extensions are warning me because they used mysql_real_escape_string().

PHP 7.1.x doesn't support mysql_real_escape_string() so I need to change to mysqli_real_escape_string() and pass my mysqli data object. The issue I have is that these extensions use the old PHP/MySQL connection as in:

$dao = CRM_Core_DAO::executeQuery($sql);

Is there some documentation I can use to quickly get up to speed on updating my code and acquiring a mysqli connection object?

Answer 1

CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like mysqli_real_escape_string. You can use it in 2 ways:

1. Parameterize your query like this:

   CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
     [1 => [$id, 'Integer']]
   );
   

2. Escape your variables beforehand with CRM_Utils_Type::escape().