SQL Injection Protection

[neoform]

Hey, I was just wondering, if I have magic quotes turned on, is this vulnerable to SQL injection attacks?

[code]
if (isset($_GET['i'])) $i=$_GET['i'];
$query = "SELECT * FROM table WHERE username = '$i'";
[/code]

If so, what could be done?

[Orio]

Basicly, yes.
But i suggest you to run this function on every input-

[code]<?php

function sql_quote($value)
{
if(get_magic_quotes_gpc())
{
$value = stripslashes($value);
}
$value = mysql_real_escape_string($value);

return $value;
}

?>[/code]

Orio.

[neoform]

See, that's what i normally do, but i have yet to find an example of what can actually be done if i don't do it.. :P  Is it really worth the extra processing?

[roopurt18]

Yes.

[neoform]

so, basically this is all a conspiracy to get everyone to use mysql_real_escape_string isn't it? I seee..............