Monday, March 16, 2009

Magic quotes in PHP

Magic quotes is mainly used for escaping or appeneding \ when a single is occured in the string which is returned in the form of $_GET or $_POST. This is used in PHP 4 and PHP 5

get_magic_quotes_gpc
Gets the current configuration setting of magic quotes gpc.Returns 0 if magic quotes gpc are off, 1 if magic quotes gpc is on.

Example:

<?php
echo get_magic_quotes_gpc(); // 1
echo $_POST['lastname']; // O\'reilly
echo addslashes($_POST['lastname']); // O\\\'reilly

if (!get_magic_quotes_gpc()) {
$lastname = addslashes($_POST['lastname']);
} else {
$lastname = $_POST['lastname'];
}

echo $lastname; // O\'reilly
$sql = "INSERT INTO lastnames (lastname) VALUES ('$lastname')";
?>

Note:
If the directive magic_quotes_sybase is ON it will completely override magic_quotes_gpc. So even when get_magic_quotes_gpc() returns TRUE neither double quotes, backslashes or NUL's will be escaped. Only single quotes will be escaped. In this case they'll look like: ''

0 comments:

Post a Comment