From c0ab9a7f6e836c9654c6dd885060c111f9595056 Mon Sep 17 00:00:00 2001
From: Kamil Tekiela <tekiela246@gmail.com>
Date: Sat, 25 Jul 2026 18:03:08 +0100
Subject: [PATCH] Add note that mssql_query() example uses a removed extension

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 security/database.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/security/database.xml b/security/database.xml
index 354d833be251..7ff968a9a195 100644
--- a/security/database.xml
+++ b/security/database.xml
@@ -330,6 +330,16 @@ $result = mssql_query($query);
      running with sufficient privileges, the attacker would now have an
      account with which to access this machine.
     </para>
+    <note>
+     <simpara>
+      The <function>mssql_query</function> function belonged to the
+      <literal>mssql</literal> extension, which was
+      <link linkend="migration70.removed-exts-sapis">removed in PHP 7.0.0</link>.
+      It is used here only to illustrate the attack; current code connecting
+      to MSSQL Server should use the <link linkend="book.sqlsrv">sqlsrv</link> or
+      <link linkend="ref.pdo-sqlsrv">pdo_sqlsrv</link> extensions instead.
+     </simpara>
+    </note>
     <note>
      <para>
       Some examples above are tied to a specific database server, but it