PHP Magic Quotes Bring security issues analysis _php Tips

The "\" character generated by the extraction of magic quotes from PHP can pose some security problems, such as the following snippet:

Foo.php?xigr= ' Ryat
function daddslashes ($string, $force = 0) {
!defined (' MAGIC_QUOTES_GPC ') && Define (' MAGIC_QUOTES_GPC ', GET_MAGIC_QUOTES_GPC ());
if (! MAGIC_QUOTES_GPC | | $force) {
if (Is_array ($string)) {
foreach ($string as $key => $val) {
$string [$key] = Daddslashes ($val, $ Force);
}
else {
$string = addslashes ($string);
}
}
return $string;
}
...
foreach (Array (' _cookie ', ' _post ', ' _get ') as $_request) {
foreach ($$_request as $_key =>) {
$_value }!= ' _ ' && $$_key = daddslashes ($_value);
}
echo $xigr [' Hi '];
echo \

The above code originally expected to get an array variable $xigr[' Hi ' after daddslashes (), but there was no strict type regulation of the variable $XIGR, when we submitted a string variable $xigr= ' Ryat, which changed from the above processing to \ ' Ryat , to the end $xigr[' Hi '] will output \, if this variable is introduced into the SQL statement, then it will cause serious security problems, then look at the following code fragment:

...
if ($XIGR) {
foreach ($xigr as $k => $v) {
$uids [] = $v [' uid '];
}
$query = $db->query ("Select UID from users WHERE uid". Implode ("', '", $uids). ");

Using the above mentioned ideas, through the submission of foo.php?xigr[]= ' &xigr[][uid]=evilcode such a structural form can easily break the GPC or similar security processing, the formation of SQL injection holes! Should give enough attention to this!