What are the best practices for handling input data and preventing SQL injection in PHP when using "magic_quotes_gpc"?

When using "magic_quotes_gpc" in PHP, it automatically escapes incoming data from forms, which can prevent SQL injection attacks. However, relying solely on this feature is not recommended as it is deprecated in PHP 5.3.0 and removed in PHP 5.4.0. It is best practice to always sanitize and validate input data before using it in SQL queries to prevent SQL injection attacks. 

// Check if magic_quotes_gpc is enabled and if so, remove the slashes
if (get_magic_quotes_gpc()) {
    $_POST = array_map('stripslashes', $_POST);
    $_GET = array_map('stripslashes', $_GET);
    $_COOKIE = array_map('stripslashes', $_COOKIE);
}

// Sanitize and validate input data before using it in SQL queries
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

// Use prepared statements to prevent SQL injection
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

magic_quotes_gpc input data SQL injection best practices PHP

Related Questions