note 63673 deleted from function.addslashes by bjori

Note Submitter: peter dot schaefer at gmail dot com Reason: in docs ---- Under PHP 4 (4.4?), magic_quotes will NOT add slashes to the keys of an array handed over in a request. If your defenses against SQL injection rely on magic_quotes and handing variables to mysql in quotes, you are likely to make mistakes here. //bad: foreach($_POST['pair'] as $key=>$value){ mysql_query("update tbl set value='$value', key='$key' "); } The same is true for scripts emulating magic_quotes, here an example picked randomly from the web: // check if magic_quotes are on for Get/Post/Cookie variables // and fix accordingly (we don't use cookies so we leave them out) if (get_magic_quotes_gpc() == 1) { while (list($key, $value) = each($_GET)) $_GET["$key"] = stripslashes($value); while (list($key, $value) = each($_POST)) $_POST["$key"] = stripslashes($value); }