How does the magic_quotes_gpc configuration option affect data processing in PHP applications?

The magic_quotes_gpc configuration option automatically adds slashes to incoming data from forms, which can lead to double escaping and security vulnerabilities in PHP applications. To solve this issue, it is recommended to disable magic_quotes_gpc and properly sanitize input data using functions like addslashes() or prepared statements to prevent SQL injection attacks. 

// Disable magic_quotes_gpc
if (get_magic_quotes_gpc()) {
    function stripslashes_deep($value) {
        $value = is_array($value) ?
                    array_map('stripslashes_deep', $value) :
                    stripslashes($value);

        return $value;
    }

    $_POST = array_map('stripslashes_deep', $_POST);
    $_GET = array_map('stripslashes_deep', $_GET);
    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}

Keywords

magic_quotes_gpc configuration option data processing PHP applications security vulnerability

Related Questions