note 20528 added to function.get-magic-quotes-gpc
| From: | sparty at d12clan dot com | Date: | Sat, 06 Apr 2002 20:06:43 +0000 |
| Subject: | note 20528 added to function.get-magic-quotes-gpc | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-28777@lists.php.net to get a copy of this message | ||
I got to playing around and noticed a possible bug, error, whatever you'd like to call it.
What if you user inputs a backslash into a field, which is then sent to the database.
Let me try and explain this better. The use inputs: \joe\ which is sent via a form to your php
script. Now, PHP with magic quotes turned on will automaticly change this variable to \\joe\\.
Nothing wrong with that. Next the variable is passed to the query where it is then stripped of the
slashes. The raw variable stored in the database is now: /joe/
However, when you go to retrieve the variable again magic quotes strips the slashes from it. This
leaves you with just: joe
Maybe I'm doing something wrong, but can someone shed some light onto this?
--
http://www.php.net/manual/en/function.get-magic-quotes-gpc.php
http://master.php.net/manage/user-notes.php?action=edit+20528
http://master.php.net/manage/user-notes.php?action=delete+20528
http://master.php.net/manage/user-notes.php?action=reject+20528