note 20528 rejected from function.get-magic-quotes-gpc by sander
| From: | sander@php.net | Date: | Sat, 06 Apr 2002 21:16:04 +0000 |
| Subject: | note 20528 rejected from function.get-magic-quotes-gpc by sander | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-28780@lists.php.net to get a copy of this message | ||
I got to playing around and noticed a possible bug, error, whatever you'd like to call it.
What if you user inputs a backslash into a field, which is then sent to the database.
Let me try and explain this better. The use inputs: \joe\ which is sent via a form to your php
script. Now, PHP with magic quotes turned on will automaticly change this variable to \\joe\\.
Nothing wrong with that. Next the variable is passed to the query where it is then stripped of the
slashes. The raw variable stored in the database is now: /joe/
However, when you go to retrieve the variable again magic quotes strips the slashes from it. This
leaves you with just: joe
Maybe I'm doing something wrong, but can someone shed some light onto this?