SQL Injection PHP

harintfs

Dear Friend,
get_magic_quotes_gpc() is turned on or off, where it decided? whether its depends on Hosting server Or, PHP Version. One more, if get_magic_quotes_gpc() turn on that means i don't need to use precaution code like mysql_real_escape_string, addslashes etc..am i correct or not? Please Thanks.

Jan 27 '12 #1

Dormilich

you’re not correct. addslashes() and mysql_real_escape_string() can escape different characters, just what PHP resp. MySQL deem necessary. I may also note that mysql_real_escape_string() (unlike Prepared Statements) can’t prevent all SQL Injection attacks.

Jan 27 '12 #2

harintfs

@Dormilich
if get_magic_quotes_gpc() is turn on, why should I care about sql injection, I thing it ll take care all

Jan 27 '12 #3

harintfs

then whats purpose of mysql_real_escape_string()

Jan 27 '12 #4

Dormilich

ever thought about SQL Injections that ain’t based upon the ' ?

answer enough?

Jan 27 '12 #5

harintfs

Pls one more ..
what are the dependency for get_magic_quotes_gpc();

Jan 27 '12 #6

harintfs

Pls one more ..
what are the dependency for get_magic_quotes_gpc(); to turn on or off...

Jan 27 '12 #7

Dormilich

PHP 4 or PHP 5, as far as I can see in the manual.

Jan 27 '12 #8

harintfs

Thank you very much. Bye.

Jan 27 '12 #9