note 31054 deleted from function.mysql-escape-string by aidan

Note Submitter: Morat ---- My approach to the slashes issue is to have a function which is called at the beginning of ever page which checks whether magic_quotes_gpc is enabled and if so calls stripslashes on all the contents of $_GET, $_POST and $_COOKIE. It also calls htmlspecialchars for each value, but this might not be to everyone's taste. I then do all my database access through a class that encapsulates connecting to and querying the database, so my db access code is centralised. The Db->query($queryString, $database) function of that class always calls mysql_escape_string on the query just before it sends it to the database. With this approach I always know that data I use in my code is unescaped, but will be properly escaped before being sent to mysql.