Answers.Body: <p>CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like <code>mysqli_real_escape_string</code>. You can use it in 2 ways:</p>
  
  <ol>
  <li><p>Parameterize your query like this:</p>
  
  <pre><code>CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
    [1 =&gt; [$id, 'Integer']]
  );
  </code></pre></li>
  <li><p>Escape your variables beforehand with <code>CRM_Utils_Type::escape()</code>.</p></li>
  </ol>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-19T21:21:44.497Z
Answers.Text: Thanks Coleman. I'm trying to find the docs on this. Can you point me in the right direction?
Answers.UserDisplayName: Andrew Wasson
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-19T21:41:10.883Z
Answers.Text: Looks like that documentation is "still to come" https://docs.civicrm.org/dev/en/latest/framework/database/
Answers.UserDisplayName: Coleman
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-19T21:45:19.373Z
Answers.Text: Have a look at the [CRM_Utils_Type::escape function](https://github.com/civicrm/civicrm-core/blob/master/CRM/Utils/Type.php#L227) to see the possible value types.
Answers.UserDisplayName: Coleman
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-19T21:56:34.763Z
Answers.Text: Thanks Coleman. That's really quite useful for what I'm doing.
Answers.UserDisplayName: Andrew Wasson
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-22T01:53:20.713Z
Answers.Text: I just want to update and confirm that indeed the appropriate method is to escape text strings using CRM_Utils_Type::escape($values['$text_value'], 'String'). Works perfectly.
Answers.UserDisplayName: Andrew Wasson
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-22T12:37:10.097Z
Answers.Text: Glad that worked. Note that the parameterized query in example 1 also sends the values through that same escape function.
Answers.UserDisplayName: Coleman
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-19T21:14:50.617Z
Answers.LastActivityDate: 2018-11-19T21:14:50.617Z
Answers.UserDisplayName: Coleman
Body: <p>I've just upgraded a site from CiviCRM 4.6.38 LTS to CiviCRM 5.7 because we upgraded the server to PHP 7.1.x. As a result 2, custom extensions are warning me because they used mysql_real_escape_string(). </p>
  
  <p>PHP 7.1.x doesn't support mysql_real_escape_string() so I need to change to mysqli_real_escape_string() and pass my mysqli data object. The issue I have is that these extensions use the old PHP/MySQL connection as in:</p>
  
  <pre><code>$dao = CRM_Core_DAO::executeQuery($sql);
  </code></pre>
  
  <p>Is there some documentation I can use to quickly get up to speed on updating my code and acquiring a mysqli connection object?</p>
  
Tags: <php>
Title: Upgrading Custom Extension for PHP 7: How to I instantiate a mysqli data object
ThreadText: # Upgrading Custom Extension for PHP 7: How to I instantiate a mysqli data object
  
  (Asked by: username_0 on 2018-11-19)
  
  I've just upgraded a site from CiviCRM 4.6.38 LTS to CiviCRM 5.7 because we upgraded the server to PHP 7.1.x. As a result 2, custom extensions are warning me because they used mysql\_real\_escape\_string().
  
  PHP 7.1.x doesn't support mysql\_real\_escape\_string() so I need to change to mysqli\_real\_escape\_string() and pass my mysqli data object. The issue I have is that these extensions use the old PHP/MySQL connection as in:
  
  ```
  $dao = CRM_Core_DAO::executeQuery($sql);
  
  ```
  
  Is there some documentation I can use to quickly get up to speed on updating my code and acquiring a mysqli connection object?
  
  **Tags:** php
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-11-19. Score: 3 | Accepted answer
  
  CiviCRM has its own database abstraction layer that can handle the escaping for you, so you don't have to use low-level functions like `mysqli_real_escape_string`. You can use it in 2 ways:
  
  1. Parameterize your query like this:
  
     ```
     CRM_Core_DAO::executeQuery('SELECT * FROM civicrm_contact WHERE id = %1',
       [1 => [$id, 'Integer']]
     );
  
     ```
  2. Escape your variables beforehand with `CRM_Utils_Type::escape()`.
  
  > **Comments:**
  > **username_0**: Thanks username_1. I'm trying to find the docs on this. Can you point me in the right direction?  
  > **username_1**: Looks like that documentation is "still to come" https://docs.civicrm.org/dev/en/latest/framework/database/  
  > **username_1**: Have a look at the [CRM_Utils_Type::escape function](https://github.com/civicrm/civicrm-core/blob/master/CRM/Utils/Type.php#L227) to see the possible value types.  
  > **username_0**: Thanks username_1. That's really quite useful for what I'm doing.  
  > **username_0**: I just want to update and confirm that indeed the appropriate method is to escape text strings using CRM_Utils_Type::escape($values['$text_value'], 'String'). Works perfectly.  
  > **username_1**: Glad that worked. Note that the parameterized query in example 1 also sends the values through that same escape function.  
  
  ---
  
  