ONJava.com -- The Independent Source for Enterprise Java
oreilly.comSafari Books Online.Conferences.


AddThis Social Bookmark Button
  Ten Security Checks for PHP, Part 1
Subject:   magic quotes
Date:   2003-03-24 13:25:09
From:   clancymalcolm
Response to: magic quotes

To demonstrate how combining addslashes with the magic_quotes_gpc = On, consider the following PHP script called test.php:

$foo = "te'st";
echo "foo=$foo<br>";
echo "bar=" . $_GET["bar"] . "

$query = sprintf("UPDATE mytable SET foo='%s', bar='%s' WHERE id=1", addslashes($foo), addslashes($_GET["bar"]));
echo "query=$query

If you don't use addslashes then the value of foo will cause an error, but if you do use addslashes you will get an extra \ in the value of the bar field.

Hope this clarifies my point.