mysqli_ has prepared queries, so it offers an immediate improvement.
In the real world dropping the mysql_* API achieved next to bugger all, we still ended up with a bunch sites with exactly the same SQL injection vulns.
They did? All of them? Nobody moved to paramaterized queries?
1) this is not an argument for leaving an inferior library in the language
2) plenty of people do update their software, for old code and large projects. Why not push people toward the better library?
The mysqli library was likely a full rewrite in another extension. Extensions, at least that kind, at that time, didn't use/have namespaces.
Keep in mind this is a legacy code base with a function called mysql_real_escape string, like if you're at that point you're so far past gone you've lost all hope.
for a 25 year library, thats not at all too bad. And even PHP developers admit that the lib was "not broken"
Only if they're used. If mysqli_ required prepared statements, then it would be different. But the sins that were committed with mysql_* could still be committed with mysqli_*.
The point wasn't "this fixed the injection problem" it was that it provided a solution not available for mysql_
it does for old code. and many people prefer a website with bugs than a website that doesn't work at all. And any website that was vulnerable to mysql_* attacks should have already been hacked out of existence by now.