PDO Prepared Statements and stripslashes

From: Date: Tue, 21 Dec 2010 04:31:15 +0000
Subject: PDO Prepared Statements and stripslashes
Groups: php.general 
Request: Send a blank email to php-general+get-310170@lists.php.net to get a copy of this message
Hi. In an article about SQL Injection by Chris Shiflett he mentions the following in a comment: "The process of escaping should preserve data, so it should never be necessary to reverse it. When I'm auditing an application, things like stripslashes() alert me to design problems." Now, I'm always using PHP PDO with prepared statements and as such data with quotes gets slashed automatically by PDO when inserted into the database. When I need to pull out the data something might be slashed and I need to use stripslashes() or some str_replace() to make sure that the slashes are removed. So what's the mistake here and what's the correct way to do it? Kind regards Rico

« previous php.general (#310170) next »