Older PHP tutorials used the obsolete mssql_* extension for SQL Server procedure calls. A modern rewrite should preserve the application behaviour while changing the database access layer.
Legacy concepts
mssql_init established a procedure call, mssql_bind supplied values, and mssql_execute ran the operation. These functions are not available in standard modern PHP installations.
Use PDO_SQLSRV for a simple procedure
$db = new PDO(
"sqlsrv:Server=localhost;Database=TrainingDB",
getenv("DB_USER"), getenv("DB_PASSWORD"),
[PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
);
$cmd = $db->prepare("EXEC dbo.GetCustomerById @CustomerID = ?");
$cmd->execute([123]);
$rows = $cmd->fetchAll(PDO::FETCH_ASSOC);Output parameter caveat
Input, output, and input/output parameter handling differs by driver. Consult current Microsoft SQLSRV and PDO_SQLSRV documentation and test nulls, Unicode strings, and multiple result sets.
Protect the application
Use least-privilege permissions, encrypted validated connections, parameterized values, exception logging, and HTML escaping at output time. Keep secrets outside the web root.
AI disclosure and reuse: This AI-generated article is rewritten from an existing Open Education post (ID 26207). Additional explanations, code examples, and version notes may have been added. You may reuse the newly generated article text with or without attribution. Third-party trademarks and linked works retain their own rights. AI can make mistakes. Check examples, permissions, supported SQL Server versions, and documentation before use in any live system.
