Re: Malicious SQL
| From: | Brian Dunning | Date: | Wed, 07 Jul 2004 17:31:17 +0000 |
| Subject: | Re: Malicious SQL | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-189884@lists.php.net to get a copy of this message | ||
I have a question about this. Here is from the documentation:
The PHP directive magic_quotes_gpc is on by default, and it essentially runs addslashes() on all GET, POST, and COOKIE data.
Why doesn't this automatically prevent injections, since it escapes out any single quotes they try to submit?
- Brian