When should stripslashes() be used in PHP code, especially in relation to 'magic quotes'?

When dealing with 'magic quotes' in PHP, stripslashes() should be used to remove escaping slashes added to incoming data. Magic quotes automatically added slashes to incoming data from forms, which could lead to double-escaping and potential security vulnerabilities. To properly handle this, use stripslashes() to remove the extra slashes before processing the data. 

// Check if magic quotes are enabled
if(get_magic_quotes_gpc()){
  // Remove escaping slashes from incoming data
  $_POST = array_map('stripslashes', $_POST);
  $_GET = array_map('stripslashes', $_GET);
  $_COOKIE = array_map('stripslashes', $_COOKIE);
}

Keywords

stripslashes PHP code magic quotes security vulnerability data sanitization

Related Questions