Is it necessary to use stripslashes() after applying magic_quotes_gpc() and mysql_real_escape_string() to user input in PHP scripts?

When using both magic_quotes_gpc() and mysql_real_escape_string() to sanitize user input in PHP scripts, it is not necessary to use stripslashes(). This is because magic_quotes_gpc() automatically adds slashes to incoming data, and mysql_real_escape_string() escapes special characters for use in SQL queries. Using stripslashes() after these functions may result in double escaping, causing errors in your code. 

// Assuming magic_quotes_gpc() is enabled by default
$input = $_POST['user_input'];
$input = mysql_real_escape_string($input);

// Use the sanitized input in your SQL query
$query = "INSERT INTO table_name (column_name) VALUES ('$input')";

Keywords

stripslashes magic_quotes_gpc mysql_real_escape_string user input PHP scripts

Related Questions