[HELP] MySQL -> MySQLi

[RastaLulz]

Hey, I'd like to start using MySQLi, rather then MySQL due security issues, etc. So I was wondering if someone who has knowledge of how to do it could convert some of my code so that I could better understand it. I know there's this thing Google, but I think this would help me better understand what I'm doing rather then looking at some other code.

config.php

<?php
ob_start();
$cloc = "localhost"; 
$cuser = "root"; 
$cpass= "######";
$cdb = "pbc";

$conn = mysql_connect("$cloc","$cuser","$cpass");
if (!$conn) die ("Could not connect MySQL.");
mysql_select_db($cdb,$conn) or die ("Could not open database");
$log = MYSQL_QUERY("SELECT * from users WHERE id='$_COOKIE[cookieid]'");
$log = mysql_fetch_array($log);

if($log[id]){
  if($_COOKIE[cookiepassword] == $log['password']){
    if($_COOKIE[cookiesecurity] == md5($log['ip'])){
      $logged = MYSQL_QUERY("SELECT * from users WHERE id='$_COOKIE[cookieid]'");
      $logged = mysql_fetch_array($logged);
    }
  }
}
?>

comments.php

<?php
if($_POST['comments']) {
 $page_p = $_GET['username'];
 $user_p = $logged['username'];
 $message_p = nl2br(strip_tags($_POST['message']));
 $date_p = date("Y-m-s");
 $time_p = date("H:i:s");
 if($message_p == NULL) {
   echo "You left the feild blank!";
 }else{
   $register = mysql_query("INSERT into `comments` (id, page, username, message, date, time) values (NULL, '$page_p', '$user_p', '$message_p', '$date_p', '$time_p');");
   echo "You have successfully left $page_p a comment.<meta HTTP-EQUIV='REFRESH' content='0; url=$page_p'>";
 }
 }else{
    $page_p = $_GET['username'];
   echo "<form method='POST'><strong>Comment Box</strong>:<br />
  <textarea rows='5' cols='60' name='message'></textarea><br /><br />
  <input type='submit' name='comments' value='Comment' align='right'>";
 }
?>

changepassword.php

<?php
if($_POST['changepassword']) {
  $password = md5($_POST['password']);
  $cpassword = md5($_POST['cpassword']);
  if($password != $cpassword) {
    echo "The passwords you entered do not match.";
  }else{
    $updatepass = mysql_query("UPDATE users SET password = '$password'");
    echo "You have successfully changed your password.";
  }
}else{
  echo "<form method='POST'>
  <strong>Change password</strong>:<br /><br />
  New password:<br />
  <input type='password' name='password' size='20'><br /><br />
  Confirm new password:<br />
  <input type='password' name='cpassword' size='20'><br /><br />
  <input type='submit' name='changepassword' value='Change Password'>";
}
?>

The coding isn't the best, but I hope you get the idea. If anyone could convert the previous code snippets, I'd appreciate it.

Thanks,
RastaLulz

 

[ExploitR]

Just change the mysql_ parts to mysqli_ simple. Unless your using prepared statements of course