Re: does magic_quotes_gpc prevents sql injection through forms?

From: Date: Mon, 11 Sep 2006 11:03:43 +0000
Subject: Re: does magic_quotes_gpc prevents sql injection through forms?
References: 1  Groups: php.general 
Request: Send a blank email to php-general+get-241577@lists.php.net to get a copy of this message
I don't think so. What if magic_quotes_gpc gets turned off or you move to another environment. Best practice is to turn if off (if you can) and so gain fine control over your data. You can either compromise and use a function that checks whether the setting is enabled and either add your own slashes or do nothing. To ensure the best level of control over escaping data before it goes into your db, check out mysql_real_escape_string. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
-- http://www.web-buddha.co.uk http://www.projectkarma.co.uk

« previous php.general (#241577) next »