[DOC-CVS] [doc-en] master: Add note that mssql_query() example uses a removed extension (#5709)

Author: Kamil Tekiela (kamil-tekiela)
Committer: GitHub (web-flow)
Pusher: kamil-tekiela
Date: 2026-07-30T21:34:45+01:00

Commit: https://github.com/php/doc-en/commit/0009ebd09f938e8f066779bb9bb774baed10bd8a
Raw diff: https://github.com/php/doc-en/commit/0009ebd09f938e8f066779bb9bb774baed10bd8a.diff

Add note that mssql_query() example uses a removed extension (#5709)

Co-authored-by: Claude Sonnet 5 <[email protected]>

Changed paths:
  M  security/database.xml


Diff:

diff --git a/security/database.xml b/security/database.xml
index 354d833be251..7ff968a9a195 100644
--- a/security/database.xml
+++ b/security/database.xml
@@ -330,6 +330,16 @@ $result = mssql_query($query);
      running with sufficient privileges, the attacker would now have an
      account with which to access this machine.
     </para>
+    <note>
+     <simpara>
+      The <function>mssql_query</function> function belonged to the
+      <literal>mssql</literal> extension, which was
+      <link linkend="migration70.removed-exts-sapis">removed in PHP 7.0.0</link>.
+      It is used here only to illustrate the attack; current code connecting
+      to MSSQL Server should use the <link linkend="book.sqlsrv">sqlsrv</link> or
+      <link linkend="ref.pdo-sqlsrv">pdo_sqlsrv</link> extensions instead.
+     </simpara>
+    </note>
     <note>
      <para>
       Some examples above are tied to a specific database server, but it