How does the magic_quotes_gpc configuration variable affect input data in PHP and how can it be properly managed?

The magic_quotes_gpc configuration variable in PHP automatically adds slashes to incoming data from forms, which can lead to data duplication and potential security vulnerabilities. To properly manage this issue, it is recommended to disable magic_quotes_gpc and manually sanitize input data using functions like addslashes() or mysqli_real_escape_string(). 

// Disable magic_quotes_gpc
if (get_magic_quotes_gpc()) {
    function stripslashes_deep($value) {
        $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value);
        return $value;
    }
    
    $_POST = array_map('stripslashes_deep', $_POST);
    $_GET = array_map('stripslashes_deep', $_GET);
    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}

// Sanitize input data
if (isset($_POST['input_field'])) {
    $input_field = addslashes($_POST['input_field']);
    // Or using mysqli_real_escape_string()
    // $input_field = mysqli_real_escape_string($connection, $_POST['input_field']);
}

Keywords

magic_quotes_gpc input data PHP configuration variable data management

Related Questions