I apologize if this question is a duplicate. I have read many other mysqli questions first, but none seemed to be an exact duplicate.
I am the senior developer on a project my company has been working on for 4+ years. It’s a large PHP MVC framework system with modules for a CMS system, an eCommerce system, and more. In total we’re talking 1583 files and ~407,912 lines of code (excluding comments and blank lines).
The system uses a propriety active-record-like system we built from the ground up, and it’s used in almost every module of the system. It was built using the old PHP mysql functions, not the new mysqli functions or PDO. PDO is a bit overkill because as a SaaS company we control the infrastructure and we’ll be using MySQL for the forseable future, so we don’t need the database abstraction. But answers on here as well as the PHP documentation have been using stronger and stronger language regarding mysql vs mysqli:
https://www.php.net/manual/en/mysqli.overview.php:
Note:
If you are using MySQL versions 4.1.3
or later it is strongly recommended
that you use the mysqli extension
instead.
Because we were using the old mysql functions, new code was thoroughly reviewed to check for SQL injection errors. It was reviewed by our staff, so it’s possible we could have missed something, but I’m fairly confident we’re covered. Because the system uses mysql functions at the code, new code must follow that convention; we can’t migrate to mysqli as we go…
Is there a benefit in rewriting the entire system to use mysqli instead? Or better asked, would the benefit be worth the fairly large cost? Or is this something we should consider when we do a major rework (in the next major version)? I’m of the mindset that if it ain’t broke, don’t fix it… but am I just being stubborn?
I don’t know if it’s worth changing over just to change. I’d seriously consider changing over for your next major revision.
Though – you’re probably better to move to a database abstraction layer, so if you do change (or they come out with mysql_super_duper() functions), you don’t have to revisit your entire code – just the abstraction code.