How does the use of magic_quotes_gpc affect the need for escaping user input in PHP?

When magic_quotes_gpc is enabled in PHP, it automatically escapes incoming data from forms, GET, and POST requests. This means that you do not need to manually escape user input before using it in SQL queries or other sensitive operations. However, magic_quotes_gpc is deprecated in PHP 5.3.0 and removed in PHP 5.4.0, so it is recommended to manually escape user input using functions like mysqli_real_escape_string or prepared statements. 

// Check if magic_quotes_gpc is enabled
if (get_magic_quotes_gpc()) {
    // Remove the automatically added slashes
    $_POST = array_map('stripslashes', $_POST);
    $_GET = array_map('stripslashes', $_GET);
    $_COOKIE = array_map('stripslashes', $_COOKIE);
}

Keywords

magic_quotes_gpc user input escaping PHP security

Related Questions