note 63673 added to function.addslashes

Under PHP 4 (4.4?), magic_quotes will NOT add slashes to the keys of an array handed over in a request. If your defenses against SQL injection rely on magic_quotes and handing variables to mysql in quotes, you are likely to make mistakes here. //bad: foreach($_POST['pair'] as $key=>$value){ mysql_query("update tbl set value='$value', key='$key' "); } The same is true for scripts emulating magic_quotes, here an example picked randomly from the web: // check if magic_quotes are on for Get/Post/Cookie variables // and fix accordingly (we don't use cookies so we leave them out) if (get_magic_quotes_gpc() == 1) { while (list($key, $value) = each($_GET)) $_GET["$key"] = stripslashes($value); while (list($key, $value) = each($_POST)) $_POST["$key"] = stripslashes($value); } ---- Server IP: 217.160.72.57 Probable Submitter: 62.153.105.10 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.addslashes.php Edit -- http://master.php.net/note/edit/63673 Del: integrated -- http://master.php.net/note/delete/63673/integrated Del: useless -- http://master.php.net/note/delete/63673/useless Del: bad code -- http://master.php.net/note/delete/63673/bad+code Del: spam -- http://master.php.net/note/delete/63673/spam Del: non-english -- http://master.php.net/note/delete/63673/non-english Del: in docs -- http://master.php.net/note/delete/63673/in+docs Del: other reasons-- http://master.php.net/note/delete/63673 Reject -- http://master.php.net/note/reject/63673 Search -- http://master.php.net/manage/user-notes.php