Is this magic quotes doing this?

[keldorn]

I was validating a form input I tried first seeing If I could do an SQL injection with no validation. This was how my query was set up.

 

 

$var = $_POST['input'];

...mysql_query("UPDATE table SET table='{$var}' WHERE....

 

 

I tried inputing things like  x" WHERE  and """"""" ''''' '''"""etc.. int the form and it had no mysql errors. It just inserted it into the database like that. 

 

So does this have something to do with Magic quotes?

[cags]

Your question seems a little vague. You say it just inserted into your database? As that is an UPDATE query not an INSERT statement I'm not sure what your getting at as your example injection attempt is blanked out.

 

Have you checked if your server has magic quotes enabled either in the php.ini or using get_magic_quotes_gpc? If they are enabled then this should prevent any SQL injection.