What's the difference between these magic_quotes_* directives?

[Ryan Lange]

Ok, I'm looking at a function whose purpose is to "prepare" the
contents (usually input by a user) of a variable to be inserted into a
MySQL database. It's pretty simple, really; just check to see if
magic_quotes_* is on and then addslashes() if it's not.

What I'm having trouble wrapping my head around is the difference
between magic_quotes_gpc and magic_quotes_runtime.

The function I'm looking at calls get_magic_quotes_runtime() to decide
whether or not to apply addslashes() to the data, but I can't help but
think that it should be calling get_magic_quotes_gpc() instead,
considering the data is coming from *outside* and going *into* the
database...

Am I misunderstanding something here, or did someone do a no-no with
that function?

- Ryan

[Janwillem Borleffs]

Ryan Lange wrote:

The function I'm looking at calls get_magic_quotes_runtime() to decide
whether or not to apply addslashes() to the data, but I can't help but
think that it should be calling get_magic_quotes_gpc() instead,
considering the data is coming from *outside* and going *into* the
database...

The get_magic_quotes_gpc function returns the status of the equally named
directive in the php.ini file, which escapes data retrieved from Get, Post
and Cookie operations (gpc). The get_magic_quotes_runtime directive handles
the data returned from functions which query a database, read a file etc.

So, which function to use is depending on where the data originates from.
JW

[Ryan Lange]

Janwillem Borleffs wrote:

So, which function to use is depending on where the data originates from.

So, am I correct in thinking that a function which takes user input and
preps it for storage into a database should check against
magic_quotes_gpc() before applying addslashes()?

- Ryan