PHP and Microsoft MSSQL SERVER

Back in 2008, connecting PHP to SQL Server was a weekend-destroying exercise. The mssql extension relied on an ancient Sybase-era client library (ntwdblib.dll), and getting a stable connection meant hunting down a specific DLL version, poking the registry, and restarting everything in the right order. If you’re here for that ritual: it’s gone, and good riddance.

The old mssql_* functions were deprecated in PHP 5.3 and removed entirely in PHP 7.0 — the manual pages no longer even exist. The right way today is Microsoft’s official PHP drivers (sqlsrv and pdo_sqlsrv), which are actively maintained (v5.13 line as of 2026) and run on both Windows and Linux.

Setup

On Windows, download the drivers from the GitHub releases page, match the ts/nts build and architecture to your PHP install, drop the DLL into your ext directory, and enable it:

; php.ini
extension=php_sqlsrv_82_ts_x64.dll
extension=php_pdo_sqlsrv_82_ts_x64.dll

The drivers need the Microsoft ODBC Driver for SQL Server (version 17 or 18) installed. On Linux, PECL handles it: pecl install sqlsrv pdo_sqlsrv, after installing the ODBC driver and dev headers.

Connecting (PDO)

Prefer PDO — it’s portable across databases and supports prepared statements everywhere:

<?php
$dsn = 'sqlsrv:Server=localhost,1433;Database=MyApp';
$pdo = new PDO($dsn, 'app_user', $password, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);

Two things that tripped up the old mssql_connect() flow and are now non-issues:

• Host naming. Named instances like (local)\SQLEXPRESS still work, but the instance needs the SQL Server Browser service (UDP 1434) or a fixed port. With a fixed port you just use host,1433 and can disable the browser service — one less thing to run.
• Dates. The old advice about formatting dates to match your regional settings (or wrapping them in # delimiters) is obsolete. The modern drivers return dates as native types, and you should be passing dates as parameters anyway — never concatenating them into SQL strings.

Queries

$stmt = $pdo->prepare(
    'SELECT id, name FROM customers WHERE created_at >= :since'
);
$stmt->execute(['since' => '2026-01-01']);
foreach ($stmt as $row) {
    echo $row['id'], $row['name'];
}

Parameterized queries solve the date-format mess permanently and close the SQL injection hole the string-concatenation era left open.

If you still inherit a legacy box running PHP 5 with ntwdblib.dll: it works until it doesn’t, and the fix is the upgrade, not more registry spelunking. The old checklist (TCP/IP protocol enabled in Configuration Manager, firewall exceptions for sqlservr.exe, port 1433 in SuperSocketNetLib\Tcp) remains accurate for the server side of any connection — those are SQL Server settings, not PHP ones.