Are there any potential pitfalls in using magic_quotes_gpc() and mysql_real_escape_string() together in PHP scripts?

Using magic_quotes_gpc() and mysql_real_escape_string() together can lead to double escaping of data, causing unexpected results or errors in your database queries. To solve this issue, you should check if magic_quotes_gpc() is enabled and only apply mysql_real_escape_string() if it is not. This way, you can ensure that data is properly escaped without double escaping. 

if(get_magic_quotes_gpc()) {
    $input = stripslashes($_POST['input']);
} else {
    $input = $_POST['input'];
}

$escaped_input = mysql_real_escape_string($input);

Keywords

magic_quotes_gpc mysql_real_escape_string PHP scripts security vulnerabilities data sanitization

Related Questions