Re: DB: does it check magic_quotes_gpc and automatically accomodate either ON or OFF?

On 9/1/05, l Burnerheimerton <lburnerheimerton@yahoo.com> wrote: > --- Justin Patrin <papercrane@gmail.com> wrote: > > > On 9/1/05, l Burnerheimerton > > <lburnerheimerton@yahoo.com> wrote: > > > It looks like, from the reading I've done, that > > using > > > autoprepare and autoexecute, or placeholders in > > > general, will quote/escape as needed. > > > > > > Is that right? > > > > I'd also like to point you to the *code*. You could > > have answered your > > question yourself by just doing a quick grep of the > > DB code. > > > > > > > > --- Justin Patrin <papercrane@gmail.com> wrote: > > > > > > > On 9/1/05, l Burnerheimerton > > > > <lburnerheimerton@yahoo.com> wrote: > > > > > I've searched the documentation and php files > > for > > > > > magic_quotes_gpc and found nothing. So > > hopefully > > > > you > > > > > guys can help me. > > > > > > > > > > I develop locally with magic_quotes_gpc=ON. I > > > > just > > > > > learned my host has magic_quotes_gpc=OFF (I > > > > haven't > > > > > uploaded anything yet so I didn't know). I > > can > > > > change > > > > > that setting and I've read both sides of that > > > > issue. > > > > > But it's really a mute point if Pear DB checks > > for > > > > the > > > > > setting of magic_quotes_gpc and determines how > > it > > > > will > > > > > escape or addslashes appropriately. > > > > > > > > > > So, will DB check this and make the needed > > > > > accomodations to allow for either > > > > magic_quotes_gpc=ON > > > > > or magic_quotes_gpc=OFF? > > > > > > > > > > > > > Why would DB deal with magic_quotes? DB is a > > > > database package, not a > > > > form package. The only package (AFAIK) which > > handles > > > > magic_quotes in > > > > PEAR is HTML_QuickForm and only if you use its > > data > > > > exporting > > > > functions. magic_quotes is bad. Period. It > > should > > > > never be used. Ever. > > > > It's the wrong solution to any problem. Please > > read > > > > my FAQ: > > > > > > > > > > > http://pear.reversefold.com/dokuwiki/doku.php?id=phpfaqs#why_is_magic_quotes_gpc_bad > > > > > > > > -- > > > > Justin Patrin > > > > > > > > -- > > > > PEAR General Mailing List (http://pear.php.net/) > > > > To unsubscribe, visit: > > http://www.php.net/unsub.php > > > > > > > > > > > > > > > > > __________________________________________________ > > > Do You Yahoo!? > > > Tired of spam? Yahoo! Mail has the best spam > > protection around > > > http://mail.yahoo.com > > > > > > -- > > > PEAR General Mailing List (http://pear.php.net/) > > > To unsubscribe, visit: > > http://www.php.net/unsub.php > > > > > > > > > > > > -- > > Justin Patrin > > Thanks Justin. I just ran ALL packages, including > base packages, through dreamweaver's code finder and > it did not find that at all. > > My main concern was running $_GET, $_POST in to the > db. I understand from your previous post that using > the autoprepare and autoexecute like I do, I should be > fine. > It is true that if you use auto* in the DB package that you don't have to run any quoting yourself. *HOWEVER* you should also turn off any magic_quotes you have to make sure things get entered correctly. If you don't you *will* run into problems with multiplying backslashes. -- Justin Patrin