diff --git a/security/database.xml b/security/database.xml
index 354d833be251..7ff968a9a195 100644
--- a/security/database.xml
+++ b/security/database.xml
@@ -330,6 +330,16 @@ $result = mssql_query($query);
      running with sufficient privileges, the attacker would now have an
      account with which to access this machine.
     </para>
+    <note>
+     <simpara>
+      The <function>mssql_query</function> function belonged to the
+      <literal>mssql</literal> extension, which was
+      <link linkend="migration70.removed-exts-sapis">removed in PHP 7.0.0</link>.
+      It is used here only to illustrate the attack; current code connecting
+      to MSSQL Server should use the <link linkend="book.sqlsrv">sqlsrv</link> or
+      <link linkend="ref.pdo-sqlsrv">pdo_sqlsrv</link> extensions instead.
+     </simpara>
+    </note>
     <note>
      <para>
       Some examples above are tied to a specific database server, but it