Magic quotes in PHP

Posted by VirtuosiMedia on Stack Overflow See other posts from Stack Overflow or by VirtuosiMedia
Published on 2008-10-21T00:50:27Z Indexed on 2010/04/22 6:13 UTC
Read the original article Hit count: 548

Filed under:
|
|

According to the PHP manual, in order to make code more portable, they recommend using something like the following for escaping data:

if (!get_magic_quotes_gpc()) {
    $lastname = addslashes($_POST['lastname']);
} else {
    $lastname = $_POST['lastname'];
}

I have other validation checks that I will be performing, but how secure is the above strictly in terms of escaping data? I also saw that magic quotes will be deprecated in PHP 6. How will that affect the above code? I would prefer not to have to rely on a database-specific escaping function like mysql_real_escape_string().

© Stack Overflow or respective owner

Related posts about php

Related posts about security