I'm not talking about MySQL, I'm talking about Microsoft SQL Server

I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided.


But what about the MSSQL function in PHP? They are, for most purposes, identical sets of functions, but the PHP page describing mssql_* carries no warning of deprecation.


There are PDO drivers available for MSSQL, but they aren't quite as readily available or used as the MySQL drivers.

Ideally, it looks to me like I should get them working and move from mssql_* to PDO like I have with MySQL, but is it as big of a priority?

Is there some hidden safety to MSSQL that means it's exempt from all of the mysql_* hatred as of late? Or is its obscurity as a backend the only reason there hasn't been more PDO encouragement?

  • 1
    Why are you paying for a sql server license but not using ASP.NET? If security is your concern, you aren't going to get a better solution than using 2 technologies developed by the same company
    – Ryathal
    Sep 12, 2012 at 13:25
  • 4
    I didn't pick either of the technologies nor am I in the position to change them. I'm just doing my best to make the most of what I'm using.
    – Will
    Sep 12, 2012 at 13:28

1 Answer 1


The MSSQL_* and MySQL_* families of functions share a common interface (i.e. similar naming), for convenience (if you know one's functions, then you know the other's) but that's where the similarities stop.

And... there's no hatred for the MySQL_* family, it's not "dangerous", its use is discouraged as it's using an older MySQL API that's no longer relevant (except for legacy applications). Right now (PHP 5.4) MySQL_* isn't actually deprecated, using its functions doesn't even raise an E_DEPRECATED error, but the extension is not actively developed, only maintained (bug fixes only, and even them are not high priority). We don't know when the functions will be actually deprecated, but the usual process is that in a future version using them will raise an E_DEPRECATED error, and at an even later version the extension will not be available as part of the default installation and will no longer be maintained.

I don't know what you mean when you say that MSSQL drivers aren't readily available, but PHP no longer bundles MySQL client libraries since the first iteration of PHP 5.0. Client libraries are essential for any database, as PHP's extensions are for the most part just wrappers of the client libraries. You'll have to install the client libraries yourself for both MySQL and MSSSQL, and perhaps you haven't noticed that yet because you are using a LAMP or WAMP bundle that installs everything for you. Still, in a vanilla setup the database's client libraries must be installed separately.

PDO offers a mostly database agnostic interface, however it's completely up to you whether you are going to use it or use MSSQL_*. If you are working with different databases, not necessarily in the same project, PDO might be the better choice as you'd have to familiarize yourself with one interface. And if your project uses multiple database then PDO is the clear winner. Personally I've moved on to PDO for all my database needs, and never looked back.

To summarize:

  • MSSQL_* and MySQL_* share a common interface for convenience, nothing more, they are just wrappers to their respective database client libraries.
  • MySQL_* soon won't be available, but MSSQL_* will.
  • Both PDO and MSSQL_* are valid choices for working with SQL Server.
  • I think you mixed up a few MySQL/MSSQLs in there but I got the gist. For the record, we do use 2 databases on one of our project(both MySQL and MSSQL). On the matter of security, can mssql_* be as secure as (properly used) PDO? Because no one thinks that you can use MySQL_* safely, and they have some realistic points about the limits of input validation and filtering. (This is more about prepared statements than anything else)
    – Will
    Sep 12, 2012 at 14:15
  • @MobyD mssql_* has absolutely nothing in common with mysql_* other than following a common naming scheme for their functions. That said, it doesn't support preparing statements, so if that's a concern for you, go with PDO. But there's no reason why mssql_* can't be as secure as PDO, if you use it properly.
    – yannis
    Sep 12, 2012 at 15:38
  • This helps to answer a lot of my questions. One last question, mssql can be as secure as PDO, but it seems to be more difficult. Without prepared statements, I would need to filter input VERY thoroughly. That said, how can one do that with MSSQL? mysql_real_escape_string is decent, but not compatible and there is no equivalent function for MSSQL. What would be a go to solution to avoid SQL injection WITHOUT the use of prepared statements in MSSQL. Preferably not this
    – Will
    Sep 12, 2012 at 16:15
  • @MobyD You could use mysqli_real_escape_string (notice the i). I've took a quick glance at some old code (haven't used SQL Server for ages), and to my horror I discovered that I used a series of preg_replace(), that's not a very smart thing to do. Use PDO ;)
    – yannis
    Sep 12, 2012 at 16:20
  • Thank you for helping me understand this subject a little more. I think the takeaway is that PDO's are most useful at saving you from your own bad decisions.
    – Will
    Sep 12, 2012 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.