mysqli vs msql and PDO connection

Question

i am trying to make a basic cms, following the tutorial here: Cms Tut

In Article.php, he uses the mysql_escape_string($order) with a PDO connection, which now is removed from php 7, i changed to mysqli_escape_string($order) and proceedes somehow but gives the errors with the 2 parameters. I am new to php, but as i searched, i think the problem is with the PDO connection, i cannot put the connection as second argument. Any thoughts and ideas? Thanks in Advance.

Here is the code:

public static function getList( $numRows=1000000, $order="publicationDate DESC" ) {
   $conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
   $sql = "SELECT SQL_CALC_FOUND_ROWS *, UNIX_TIMESTAMP(publicationDate) AS publicationDate FROM articles
           ORDER BY " . mysqli_escape_string($order) . " LIMIT :numRows";

   $st = $conn->prepare( $sql );
   $st->bindValue( ":numRows", $numRows, PDO::PARAM_INT );
   $st->execute();
   $list = array();

   while ( $row = $st->fetch() ) {
     $article = new Article( $row );
     $list[] = $article;
   }

   // Now get the total number of articles that matched the criteria
   $sql = "SELECT FOUND_ROWS() AS totalRows";
   $totalRows = $conn->query( $sql )->fetch();
   $conn = null;
   return ( array ( "results" => $list, "totalRows" => $totalRows[0] ) );
 }

After updating the code, with creating a mysqli connection, in browser there is , this error: mysqli_connect(): (HY000/2002): php_network_getaddresses: getaddrinfo failed: No such host is known.

and in server error log also this: Call to a member function real_escape_string() on boolean

The update code is:

public static function getList( $numRows=1000000, $order="publicationDate DESC" ) {
   $conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
   $link = mysqli_connect(DB_USERNAME, DB_PASSWORD, DB_DSN);

   $sql = "SELECT SQL_CALC_FOUND_ROWS *, UNIX_TIMESTAMP(publicationDate) AS publicationDate FROM articles
           ORDER BY " . $link->real_escape_string($order) . " LIMIT :numRows";

   $st = $conn->prepare( $sql );
   $st->bindValue( ":numRows", $numRows, PDO::PARAM_INT );
   $st->execute();
   $list = array();

   while ( $row = $st->fetch() ) {
     $article = new Article( $row );
     $list[] = $article;
   }

   // Now get the total number of articles that matched the criteria
   $sql = "SELECT FOUND_ROWS() AS totalRows";
   $totalRows = $conn->query( $sql )->fetch();
   $conn = null;
   return ( array ( "results" => $list, "totalRows" => $totalRows[0] ) );
 }

Answer 1

You need to pick one of mysql_ , mysqli_ and PDO (don't pick mysql_ ).

You can't mix PDO and mysqli_ .

You don't need to use mysqli_escape_string to defend PDO against SQL injection; it has its own methods (which you are already using for nubRows !!).

See How can I prevent SQL injection in PHP? for guidance on handling special characters with PDO.