Why php escapes characters in POST and GET?

mikek12004

I was wondering why PHP escapes the single quotes in a GET or POST variable? is it just for display purposes or the single quot can mess up other things too? And it escapes just the single quote or also and other characters?

Markus

Quote:

Originally Posted by mikek12004

I was wondering why PHP escapes the single quotes in a GET or POST variable? is it just for display purposes or the single quot can mess up other things too? And it escapes just the single quote or also and other characters?

You have magic quotes enabled. The idea behind it was to sanitize any input through GET, POST, etc., so that it would be safe to insert into a database. However, it was a stupid idea because not all of request data is going to be used in databases.

Notice the deprecation warning.

- mark.

mikek12004

So you would suggest stripslashes right after the post use it wherever I want and mysql_real_escape_string for those data intended for the database?

Dormilich

it is probably better to disable magic quotes. this can be done in 2 ways, disable it permanently by changing the value of magic_quotes_gpc to Off or 0 in the php.ini or disable it temporarly by using ini_set()

mikek12004

well I use stripslashes without first checking magic_quotes you believe it would be a problem if I used stripslashes on a string that hasn't been escaped?
And to temporary disable it I do it in the page with the form or in the target page or in both?

Dormilich

Quote:

Originally Posted by mikek12004

And to temporary disable it I do it in the page with the form or in the target page or in both?

it doesn't matter where it is done, but the new setting will only be available after the call (and be valid until the script finishes). So it is best to do it as early as possible (I guess this would be the target page).

Why php escapes characters in POST and GET?

re: Why php escapes characters in POST and GET?

re: Why php escapes characters in POST and GET?

re: Why php escapes characters in POST and GET?

re: Why php escapes characters in POST and GET?

re: Why php escapes characters in POST and GET?

Similar PHP bytes

/bytes/development

/bytes/it

/bytes/about