note 68042 added to function.get-magic-quotes-gpc

When you work with forms and databases you should use this concept: 1.When inserting the user input in DB escape $_POST/$_GET with add_slashes() or similar (to match the speciffic database escape rules) $query='INSERT INTO users SET fullname="'.add_slashes($_POST['fullname']).'"'; insert_into_db($query); 2.When reading a previously submitted input from DB use html_special_chars to display an escaped result! read_db_row('SELECT fullname FROM users'); echo '<input type="text" name="fullname" value="'.html_special_chars($db_row['fullname']).'" /> this way you safely store and work with the original(unescaped) data. ---- Server IP: 217.75.128.29 Probable Submitter: 83.228.60.26 ---- X-Spam-Status: No, hits=3.3 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER, HTML_MESSAGE autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.get-magic-quotes-gpc.php Edit -- http://master.php.net/note/edit/68042 Del: integrated -- http://master.php.net/note/delete/68042/integrated Del: useless -- http://master.php.net/note/delete/68042/useless Del: bad code -- http://master.php.net/note/delete/68042/bad+code Del: spam -- http://master.php.net/note/delete/68042/spam Del: non-english -- http://master.php.net/note/delete/68042/non-english Del: in docs -- http://master.php.net/note/delete/68042/in+docs Del: other reasons-- http://master.php.net/note/delete/68042 Reject -- http://master.php.net/note/reject/68042 Search -- http://master.php.net/manage/user-notes.php