What are best practices for handling magic_quotes_gpc settings in PHP to prevent issues with escaping characters in user input?

Magic quotes GPC was a feature in older versions of PHP that automatically escaped characters in user input. This feature is now deprecated and can cause issues with double escaping characters if left enabled. To prevent problems with escaping characters in user input, it is recommended to disable magic quotes GPC and manually escape input using functions like `mysqli_real_escape_string()` or prepared statements. 

// Disable magic quotes GPC
if (get_magic_quotes_gpc()) {
    function stripslashes_deep($value) {
        $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value);
        return $value;
    }
    
    $_POST = array_map('stripslashes_deep', $_POST);
    $_GET = array_map('stripslashes_deep', $_GET);
    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}

// Manually escape user input
$input = $_POST['user_input'];
$escaped_input = mysqli_real_escape_string($connection, $input);
// or use prepared statements
$stmt = $connection->prepare("INSERT INTO table_name (column_name) VALUES (?)");
$stmt->bind_param("s", $input);
$stmt->execute();

Keywords

magic_quotes_gpc PHP user input escaping characters security

Related Questions