Re: magic_quotes

Johannes Lindenbaum wrote:

Evening, I am new to this list, so please if this email is "offensive" to anyone I didn't know any better. Not here to start a war or similar. I have a couple questions about magic_quotes and it's deletion in PHP 6. I've been lazily following php.internals and read about register_globals and magic_quotes (finally) being deleted from PHP. I don't have any scripts that run with register_globals - not worried about PHP 6 for that case. But... magic_quotes. If my understanding is correct magic quotes will give ', " and \ (for ASCII characters, e.g. \n) a preceding backslash to escape it. I also see that magic_quotes_gpc() is On by default. So all data in $_POST and $_GET etc. has escaping backslashes. If in a .htaccess I should set php_flag magic_quotes_gpc Off That would lead to $_POST data like Jingle's Bells to be passed as Jingle's Bells, not Jingle\'s Bells. Usually most of my $_POST data gets written into a MySQL table to which I perform addslashes(). And on retrieval stripslashes(). If I keep on doing that - and just start coding with magic_quotes_gpc Off - my scripts shouldn't alter behaviour upon PHP 6 arrival, should they?

That part is correct. You shouldn't need to use addslashes - use mysql_real_escape_string or mysql_escape_string depending on your (current) php version - they are both "locale aware" and will escape things for you depending on mysql server (re: language setup). Then just use htmlentities to display on the frontend rather than using stripslashes. Of course other db's have similar functions, check the manual. -- Postgresql & php tutorials http://www.designmagick.com/