Phpget_magic_quotes_gpc () function use _ MySQL

Phpget_magic_quotes_gpc () function uses the magic_quotes_gpc function in php to determine the data prompted by the user, such as adding the escape character "/" to the data from post, get, and cookie. to ensure that the data will not cause the program, especially the database statements may cause fatal errors due to pollution caused by special characters.

In the case of magic_quotes_gpc = On, if the input data has

Single quotation marks ('), double quotation marks ("), backslash (/), and NULL (NULL) are all added with a backslash. These escaping are required. if this option is off, we must call the addslashes function to add escaping to the string.

It is precisely because this option must be On, but there is a conflict between the user's configuration. after this option is deleted in PHP6, all programming needs to be done under magic_quotes_gpc = Off. In such an environment, if user data is not escaped, the consequences are not just program errors. Similarly, it may cause the risk of database injection attacks. Therefore, from now On, you should not rely On this setting to be On any more, so that one day your server will need to be updated to PHP6 and your program will not work properly.

The code is as follows:
When magic_quotes_gpc = On, the get_magic_quotes_gpc () function returns 1. When magic_quotes_gpc = Off, the get_magic_quotes_gpc () function returns 0.

Therefore, the function get_magic_quotes_gpc () is used to obtain the value of the environment variable magic_quotes_gpc. Since the magic_quotes_gpc option is deleted in PHP6, this function will no longer exist in PHP6.

Php checks whether the get_magic_quotes_gpc function is enabled, so that we can determine whether to use the addslashes function.

The code is as follows:
Function SQLString ($ c, $ t ){ $ C = (! Get_magic_quotes_gpc ())? Addslashes ($ c): $ c; Switch ($ t ){ Case 'text ': $ C = ($ c! = '')? "'". $ C. "'": 'null '; Break; Case 'Search ': $ C = "'%". $ c. "% '"; Break; Case 'int ': $ C = ($ c! = '')? Intval ($ c): '0 '; Break; } Return $ c; }

Best practices for preventing database attacks

The code is as follows:

Function check_input ($ value) { // Remove the slash If (get_magic_quotes_gpc ()) { $ Value = stripslashes ($ value ); } // If it is not a number, enclose it with quotation marks. If (! Is_numeric ($ value )) { $ Value = "'". mysql_real_escape_string ($ value). "'"; } Return $ value; } $ Con = mysql_connect ("localhost", "hello", "321 ″); If (! $ Con) { Die ('could not connect: '. mysql_error ()); } // Perform a safe SQL statement $ User = check_input ($ _ POST ['user']); $ Pwd = check_input ($ _ POST ['pwd']); $ SQL = "SELECT * FROM users WHERE User = $ user AND password = $ pwd "; Mysql_query ($ SQL ); Mysql_close ($ con ); ?>