RE: [PHP] does magic_quotes_gpc prevents sql injection through forms?
| From: | Reinhart Viane | Date: | Mon, 11 Sep 2006 13:42:18 +0000 |
| Subject: | RE: [PHP] does magic_quotes_gpc prevents sql injection through forms? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-241587@lists.php.net to get a copy of this message | ||
>I think the more likely attack is actually due to how annoying
>magic_quotes is. You have to remove it to do any work, then you have to
>remember to put it back on because you aren't escaping your sql.
>David
What exactly do you mean by ' You have to remove it to do any work '?
Seems that the only and best way to prevent mysql injection is the
combination of mysql_real_escape_string combined with value validation.