Magic Quotes / mysql_real_escape_string

[johnsmith153]

I have been using mysql_real_escape_string for ages but have come across a site using Magic Quotes

 

Using the modern method I simply use mysql_real_escape_string and htmlspecialchars to ensure all data is posted, added to db and displayed to user.

 

What do I need to do with Magic Quotes enabled (I can't turn them off and do properly)

[AbraCadaver]

if(get_magic_quotes_gpc()) {
   $your_var = stripslashes($your_var);
}
$your_var = mysql_real_escape_string($your_var);

 

 

No need to use htmlentities() to store.  Use it for display.