Solving SQL injection_php with PHP functions

Sqlinjection

SQL injection problem on the ASP but there are also many famous PHP programs at home and abroad, "killed." As for the details of SQL injection, there are so many articles on the Internet that we don't introduce them here.
If the MAGIC_QUOTES_GPC in your php.ini file in your Web space is set to OFF, then PHP will not precede the sensitive character with a backslash (\), because the content submitted by the form may contain sensitive characters, such as single quotation marks ('), resulting in a vulnerability to SQL injection. In this case, we can use Addslashes () to solve the problem, which automatically adds a backslash before the sensitive character.
However, the above method only applies to magic_quotes_gpc=off cases. As a developer, you don't know if each user's MAGIC_QUOTES_GPC is on or off, and if all of the data is addslashes (), isn't that "killing innocents"? If Magic_quotes_gpc=on, and the Addslashes () function is used again, let's take a look at:
If a variable $_post[' message ' is submitted from the form, the content is Tom's book
This adds the code to connect to the MySQL database, write it Yourself
Precede the sensitive character of $_post[' message ' with a backslash
$_post[' message ' = addslashes ($_post[' message ');

Because of the magic_quotes_gpc=on, the backslash is added again before the sensitive character
$sql = "INSERT into msg_table VALUE (' $_post[message] ');";

Send the request to save the content in the database
$query = mysql_query ($sql);

If you extract this record from the database and output it, you will see Tom\ 's book
?>

This way, in a magic_quotes_gpc=on environment, all the input single quotes (') will become (\ ') ...
In fact, we can easily solve this problem with the GET_MAGIC_QUOTES_GPC () function. The function returns True when Magic_quotes_gpc=on, and returns False when Magic_quotes_gpc=off. At this point, there must have been a lot of people realize: the problem has been solved. Look at the code:
!--? php
//If magic_quotes_gpc=off, then the sensitive word in the $_post[' message ' that is submitted for the bill of lading multibyte backslash
//magic_quotes_gpc= On, do not add
if (!GET_MAGIC_QUOTES_GPC ()) {
$_post[' message '] = addslashes ($_post[' message ");
} else {}
?

Actually speaking here, the problem has been solved. Here's a little trick.
Sometimes a form submits more than one variable, and there can be more than 10 or dozens of of these. Copy/Paste the addslashes () once and again, is it a bit of a hassle? Since the data obtained from the form or URL is in the form of an array, such as $_post, $_get, then customize a function that can "annihilation":
function quotes ($content)
{
If Magic_quotes_gpc=off, then start processing
if (!GET_MAGIC_QUOTES_GPC ()) {
Determine if the $content is an array
if (Is_array ($content)) {
If $content is an array, then it is processed by every single
foreach ($content as $key = = $value) {
$content [$key] = addslashes ($value);
}
} else {
If $content is not an array, it is processed only once
Addslashes ($content);
}
} else {
If magic_quotes_gpc=on, then do not deal with
}
Back to $content
return $content;
}
?>

