Magic quotes in PHP
Posted
by VirtuosiMedia
on Stack Overflow
See other posts from Stack Overflow
or by VirtuosiMedia
Published on 2008-10-21T00:50:27Z
Indexed on
2010/04/22
6:13 UTC
Read the original article
Hit count: 548
According to the PHP manual, in order to make code more portable, they recommend using something like the following for escaping data:
if (!get_magic_quotes_gpc()) {
$lastname = addslashes($_POST['lastname']);
} else {
$lastname = $_POST['lastname'];
}
I have other validation checks that I will be performing, but how secure is the above strictly in terms of escaping data? I also saw that magic quotes will be deprecated in PHP 6. How will that affect the above code? I would prefer not to have to rely on a database-specific escaping function like mysql_real_escape_string().
© Stack Overflow or respective owner