I am getting an error regarding mssql_real_escape_string() - php

Question

Please help to cure this error:
Fatal error: Call to undefined function mssql_real_escape_string() in
The Code:
<?php
$host="-Removed-"; // Host name
$username="-Removed-"; // Mysql username
$password="-Removed-"; // Mysql password
$db_name="-Removed-"; // Database name
$tbl_name="USERPASS";
$tbl_name2="EMPLOYEES"; // Table name
// Connect to server and select databse.
mssql_connect("$host", "$username", "$password")or die("cannot connect");
mssql_select_db("$db_name")or die("cannot select DB");
// username and password sent from form
$myusername=$_POST['login'];
$mypassword=$_POST['password'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mssql_real_escape_string($myusername);
$mypassword = mssql_real_escape_string($mypassword);
$sql="SELECT *
FROM $tbl_name U, $table_name2 E
WHERE U.EMPLOYEE_ID = E.EMPLOYEE_ID
AND USERNAME='$myusername'
AND PASSWORD='$mypassword'";
$result=mssql_query($sql);
// Mysql_num_row is counting table row
$count=mssql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
?>
.
Thank You for the help! Been trying to figure this out for forever now.

Answer 1

That's because thereisn't any php function called mssql_real_escape_string

Answer 2

If your using MSSQL Server there is no mssql_real_escape_string, only MySQL and MySQLi have it, at least I didn't find it:
http://php.net/manual/en/book.mssql.php
http://php.net/manual/en/ref.mssql.php

Answer 3

Unfortunately, as of right now, PHP mssql extension neither supports parameterized queries nor has an escape function. You have to either write your own escape function or use something like PDO prepared statements to prevent SQL injection.