Should you add slashes to a variable everytime you are going to place it in a db

[Greaser9780]

Should you add slashes to a variable everytime you are going to place it in a db?

[Jessica]

Yes. Use the php function for the database, not addslashes(). If you're using mysql, use mysql_real_escape_string().

 

If you have magic_quotes_gpc on, you should first stripslashes as it adds its own.

[Greaser9780]

Like this:

array_pop($_POST);

if ( get_magic_quotes_gpc() ) {

    $_POST= array_map('stripslashes', $_POST);

}

$clan_name = mysql_real_escape_string(trim($_POST['clan_name']));