About PHP's Magic quotes ____php

The content from the PHP manual (http://php.net/manual/zh/security.magicquotes.what.php) is recorded.

When Magic quotes open, all '(single quotes),"(double quotes),\(backslashes), and NULL characters are automatically escaped with a backslash. This is exactly the same as the addslashes () function.

A total of three magic quotes instruction: MAGIC_QUOTES_GPC affects HTTP request data (Get,post and cookies). Cannot be changed at run time. In PHP , the default value is on. See GET_MAGIC_QUOTES_GPC (). Magic_quotes_runtime if opened, most of the data returned from external sources, including from the database and text files, will be escaped by backslashes. This option can be changed at run time, and the default value in PHP is off. See Set_magic_quotes_runtime () and Get_magic_quotes_runtime (). Magic_quotes_sybase if opened, the single quotation marks are used to escape instead of the backslash. This option will completely overwrite MAGIC_QUOTES_GPC. If you open two options at the same time, the single quote will be escaped as '. Double quotes, backslashes, and NULL characters are not escaped. How to get its value see Ini_get (). In order to write code that is highly portable (which can run in any environment), such as inability to modify the server configuration, the following example can turn off MAGIC_QUOTES_GPC at run time. But this is relatively inefficient, the appropriate modification of the configuration is a better way.

Here's how to turn off the magic quotes at run time:

<?php
if (GET_MAGIC_QUOTES_GPC ()) {
    function stripslashes_deep ($value)
    {
        $value = Is_array ($ Value)?
                    Array_map (' Stripslashes_deep ', $value):
                    stripslashes ($value);

        return $value;
    }

    $_post = Array_map (' Stripslashes_deep ', $_post);
    $_get = Array_map (' Stripslashes_deep ', $_get);
    $_cookie = Array_map (' Stripslashes_deep ', $_cookie);
    $_request = Array_map (' Stripslashes_deep ', $_request);
>

For earlier versions of PHP, processing is as follows:

1. For the magic_quotes_gpc=on situation,
We can not do addslashes () and Stripslashes () of the string data of the input and output databases, and the data will be displayed normally. If you addslashes () the input data at this time,
Then you must use Stripslashes () in the output to remove the extra backslash.

2. For the Magic_quotes_gpc=off situation
You must use Addslashes () to process the input data, but you do not need to format the output with Stripslashes () because Addslashes () did not write the backslash along with the database, only to help MySQL complete the execution of the SQL statement.