PHP-Magic Quotes simple tutorial

Source: Internet
Author: User
Tags sql injection

-Magic quotes of PHP
A function called magic quotes was previously created in PHP 6 to help protect novice programmers from writing bad table processing code. Magic quotes automatically avoids dangerous form data and may be used for SQL injection with a backslash. PHP escape characters include quotation marks, double quotation marks, backslash, and NULL characters.

Tizag.com
However, this newbie protection proves that more problems are caused than solved, rather than in PHP 6. If any version of your PHP version is 6 days ago, you should use this lesson to learn how magic quotes may affect you.

Magic quotes-what do they make?
First, you need to check if you have magic quotes to make your server. The get_magic_quotes_gpc function returns 0 (off) or 1 (on ). These Boolean values are suitable for making a good speech. If 1 is true, 0 is false.

If (get_magic_quotes_gpc ())
Echo "Magic quotes are enabled ";
Else
Echo "Magic quotes are disabled ";

The output is related to whether php is enabled.

Magic quotes in action
Now you can make a simple form to show how processor machines with magic quotes will enable those who may escape danger. This form is submitted to yourself, so you only need to make a file, "Magic quotes. php" to test it.

<? Php
Echo "Altered Text:". $ _ POST ['question'];
?>

<Form method = 'post'>
Question: <input type = 'text' name = 'question '/> <br/>
<Input type = 'submit '>

</Form>

Remove the backslash-s tripslashes () function
When using PHP's backslash clearing function stripslashes, it intelligently adds some magic quotes like our check ", are they enabled? . In this way, you will not be accidentally deleted as the slash is legal. In the future, if your PHP magic quotes settings change in the future.

<? Php
Echo "Removed Slashes :";
// Remove those slashes
If (get_magic_quotes_gpc ())
Echo stripslashes ($ _ POST ['question']);
Else
Echo $ _ POST ['question '];

?>

<Form method = 'post'>
Question: <input type = 'text' name = 'question '/> <br/>
<Input type = 'submit '>

</Form>

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.