I've just upgraded a site from CiviCRM 4.6.38 LTS to CiviCRM 5.7 because we upgraded the server to PHP 7.1.x. As a result 2, custom extensions are warning me because they used mysql_real_escape_string().

PHP 7.1.x doesn't support mysql_real_escape_string() so I need to change to mysqli_real_escape_string() and pass my mysqli data object. The issue I have is that these extensions use the old PHP/MySQL connection as in:

$dao = CRM_Core_DAO::executeQuery($sql);

Is there some documentation I can use to quickly get up to speed on updating my code and acquiring a mysqli connection object?

1 Answer 1


CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like mysqli_real_escape_string. You can use it in 2 ways:

  1. Parameterize your query like this:

    CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
      [1 => [$id, 'Integer']]
  2. Escape your variables beforehand with CRM_Utils_Type::escape().

  • Thanks Coleman. I'm trying to find the docs on this. Can you point me in the right direction? Commented Nov 19, 2018 at 21:21
  • Looks like that documentation is "still to come" docs.civicrm.org/dev/en/latest/framework/database
    – Coleman
    Commented Nov 19, 2018 at 21:41
  • 1
    Have a look at the CRM_Utils_Type::escape function to see the possible value types.
    – Coleman
    Commented Nov 19, 2018 at 21:45
  • Thanks Coleman. That's really quite useful for what I'm doing. Commented Nov 19, 2018 at 21:56
  • 1
    Glad that worked. Note that the parameterized query in example 1 also sends the values through that same escape function.
    – Coleman
    Commented Nov 22, 2018 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.