MySQLi script to print the name of a user I made my first script of MySQLi. I have just learnt it from 3rd party website. So, I am not sure I am using functions which are not deprecated or outdated. I should start to practice good scripts to access databases. So, I have posted here. Any mistake you see, please point it out.

&lt;?php

include "functions.php";

$a = checkLogin();

if($a==1) {
    $id = $_COOKIE['id'];

    include "databaseConnector.php";

    $query = $mysqli-&gt;query("SELECT * FROM users WHERE id = '$id'") or die($mysqli-&gt;error.__LINE__);

    if($query-&gt;num_rows &gt; 0) {
        while($row = $query-&gt;fetch_assoc()) {
?&gt;
            &lt;?php echo stripslashes($row['firstname'])." ".stripslashes($row['lastname']); ?&gt;   
&lt;?php
        }
    }
    else {
        return false;   
    }
}
else {
    redirectIndex();
}

?&gt;
You are vulnerable to SQL injection. Always use prepared statements with parameterized queries.

The below example fixes these issues. In this example I am using PDO instead, which is similar to mysqli but more powerful and supports other databases than just MySQL.

&lt;?php

include "functions.php";

$a = checkLogin();

if ($a == 1) {
    $id = $_COOKIE['id'];

    // include "databaseConnector.php";
    // --------------------------------------------------------------------------------------------------
        try {
            $handle = new PDO("mysql:host=$host_addr;dbname=$database", $username, $password);
            $handle-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        } catch(PDOException $e) {
            echo 'ERROR: ' . $e-&gt;getMessage();
        }
    // --------------------------------------------------------------------------------------------------

    // UNBOUND PARAMETERS VERSION
        $query = "SELECT * FROM users WHERE id = '$id'";
        $statement = $handle-&gt;prepare($query);
        $statement-&gt;execute();

    // BOUND PARAMETERS VERSION
        $query = "SELECT * FROM users WHERE id = :id";
        $statement = $handle-&gt;prepare($query);
        $params = array(":id" =&gt; $id);
        $statement-&gt;execute($params);

    $row_count = $statement-&gt;rowCount();
    $result    = $statement-&gt;fetchAll(PDO::FETCH_ASSOC);

    if($row_count &gt; 0) {
        foreach ($result as $row =&gt; $col) {
            echo $col['firstname']." ".$col['lastname']; 
        }
    } else {
        return false;   
    }
} else {
    redirectIndex();
}

?&gt;