Why php escapes characters in POST and GET?

[mikek12004]

I was wondering why PHP escapes the single quotes in a GET or POST variable? is it just for display purposes or the single quot can mess up other things too? And it escapes just the single quote or also and other characters?

[Markus]

@mikek12004
You have magic quotes enabled. The idea behind it was to sanitize any input through GET, POST, etc., so that it would be safe to insert into a database. However, it was a stupid idea because not all of request data is going to be used in databases.

Notice the deprecation warning.

- mark.

[mikek12004]

So you would suggest stripslashes right after the post use it wherever I want and mysql_real_escape_string for those data intended for the database?

[Dormilich]

it is probably better to disable magic quotes. this can be done in 2 ways, disable it permanently by changing the value of magic_quotes_gpc to Off or 0 in the php.ini or disable it temporarly by using ini_set()

[mikek12004]

well I use stripslashes without first checking magic_quotes you believe it would be a problem if I used stripslashes on a string that hasn't been escaped?
And to temporary disable it I do it in the page with the form or in the target page or in both?

[Dormilich]

@mikek12004
it doesn't matter where it is done, but the new setting will only be available after the call (and be valid until the script finishes). So it is best to do it as early as possible (I guess this would be the target page).