flash gordon Posted November 23, 2009 Share Posted November 23, 2009 I'm trying to test out my security a bit and I've noticed that php is escaping my single quotes. For instance I enter x' OR 1=1-- in a form and the output it gives me is x\' OR 1=1--. Is there a setting in php or apache that automatically escapes single quotes? cheers. Link to comment https://forums.phpfreaks.com/topic/182619-php-automatically-escaping-single-quotes/ Share on other sites More sharing options...
Mchl Posted November 23, 2009 Share Posted November 23, 2009 http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-gpc Link to comment https://forums.phpfreaks.com/topic/182619-php-automatically-escaping-single-quotes/#findComment-963850 Share on other sites More sharing options...
flash gordon Posted November 23, 2009 Author Share Posted November 23, 2009 thank you. And even though this is deprecated, it's a good thing that the single quotes are automatically escaped? What's the replacement to the deprecated property? Link to comment https://forums.phpfreaks.com/topic/182619-php-automatically-escaping-single-quotes/#findComment-963863 Share on other sites More sharing options...
Mchl Posted November 23, 2009 Share Posted November 23, 2009 You should not rely on this function (as stated in manual). It's better to turn it off all together (if possible) You should instead escape your data just before putting it into your database queries. Use specialised functions for that, like mysql_real_escape_string for ext\mysql Link to comment https://forums.phpfreaks.com/topic/182619-php-automatically-escaping-single-quotes/#findComment-963865 Share on other sites More sharing options...
flash gordon Posted November 23, 2009 Author Share Posted November 23, 2009 alrighty. thank you much for the help. cheers [RESOLVED] Link to comment https://forums.phpfreaks.com/topic/182619-php-automatically-escaping-single-quotes/#findComment-963870 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.