What is the purpose of magic quotes in PHP and how does it affect data input from forms?

Magic quotes in PHP was a feature that automatically added slashes to incoming data from forms, which was intended to help prevent SQL injection attacks. However, this feature is deprecated as of PHP 5.3.0 and removed in PHP 5.4.0 due to its potential to cause data corruption and security vulnerabilities. To ensure data input from forms is secure, it is recommended to use prepared statements with parameterized queries or input validation functions. 

// Disable magic quotes
if (get_magic_quotes_gpc()) {
    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
    while (list($key, $val) = each($process)) {
        foreach ($val as $k => $v) {
            unset($process[$key][$k]);
            if (is_array($v)) {
                $process[$key][stripslashes($k)] = $v;
                $process[] = &$process[$key][stripslashes($k)];
            } else {
                $process[$key][stripslashes($k)] = stripslashes($v);
            }
        }
    }
    unset($process);
}

Keywords

magic quotes PHP data input forms security

Related Questions