What role do magic quotes play in PHP when it comes to inserting or updating data in a database?

Magic quotes in PHP automatically add slashes to incoming data, which can cause issues when inserting or updating data in a database. To solve this issue, you should disable magic quotes and use prepared statements or parameterized queries to safely insert or update data in the database. 

// Disable magic quotes
if (get_magic_quotes_gpc()) {
    function stripslashes_deep($value) {
        $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value);
        return $value;
    }
    
    $_POST = array_map('stripslashes_deep', $_POST);
    $_GET = array_map('stripslashes_deep', $_GET);
    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}

// Use prepared statements to insert data into the database
$stmt = $pdo->prepare("INSERT INTO table_name (column1, column2) VALUES (:value1, :value2)");
$stmt->bindParam(':value1', $value1);
$stmt->bindParam(':value2', $value2);
$stmt->execute();

Keywords

magic quotes PHP data insertion data updating database

Related Questions