Is mysql_real_escape_string necessary if magic_quotes are enabled in PHP?

If magic_quotes are enabled in PHP, it automatically escapes incoming data from forms, GET, and POST requests. This means that using mysql_real_escape_string is not necessary as the data is already being escaped. However, it is important to note that magic_quotes is deprecated as of PHP 5.3.0 and removed in PHP 5.4.0, so it is recommended to use prepared statements or mysqli_real_escape_string instead. 

// Check if magic_quotes are enabled
if(get_magic_quotes_gpc()) {
    $name = stripslashes($_POST['name']);
    $email = stripslashes($_POST['email']);
    // Use the escaped values in your SQL query
} else {
    // If magic_quotes are not enabled, use mysqli_real_escape_string or prepared statements
}

Keywords

mysql_real_escape_string magic_quotes PHP security SQL injection

Related Questions