Converting mysql_* to mysqli_* issue

Question

I am using MySQLConverterTool to convert my web application,

first issue i faced is code getting to big i dont even understand what that means? It was very small code before and now i see this is too big.

//old code
$ask_id = mysql_real_escape_string($_POST['ask_id']);

//after convert
$ask_id = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $_POST['ask_id']) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

Its working fine but i want to know if its correct way of mysqli_* or is there some issue or bug i need to fix in line?

I also want to know how i can make this part secure

if (isset($_POST['asking-money'])) {
    $dailyBonus = 10000;
    $update = mysqli_query($GLOBALS["___mysqli_ston"], "UPDATE users SET ask_time='$newtime', bonus='dailyBonus'  WHERE id='$userid'");
// some more calculation
}

Answer 1

The first bit of code looks like it (grossly) added a giant ternary statement to check that the variables you were using were at least set, but other than that you should just be able to use:

mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $_POST['ask_id'])

As for security with the SQL query, try using Prepared Statements instead of directly querying with variables

mysqli_prepare

Answer 2

for the mysqli_* part, most of the things that used to be done with mysql_* remained almost the same with a new prefix, so, most likely there is no problem and for the how to make it secure, just evaluate and prepare all the parameters being passed from the user before using them in the query, in other words, NEVER under any case, use the user input directly in a query. other than that the code seems very fine to me.

Answer 3

The first code is a ternary statement (short way for if/else). Way too much, my opinion.

I recommend PDO and it's prepared statements , if you're able to use it. It's very secure and easy to handle.

By the way: try to avoid the MySQLConverterTool . It's hard to get into this code after months. K eep i t s mart and s imple! :-)

Good luck!