Now how hard it is to add around 10 lines of code (one function) to your script that is added to every page. IMHO all projects have those.
You should never ever have get_magic_quotes checks more than in one place, and rest code assumes they are off or stripped away.
All data incoming to database should have mysql_real_escape_string applaid to it if the values beeing inserted are strings.
In the following example it's useless to use mysql_real_escape_string as the value don't have '' around it as it's a INT beeing inserted.
$sql ="insert into numbers (nro) values(".mysql_real_escape_srting('5').")";
With this you should be ok with every possible server, just call it once in your script to remove the effect of magic_quotes.
Quote:
<?php
if (get_magic_quotes_gpc()) {
$in = array(&$_GET, &$_POST, &$_COOKIE);
while (list($k,$v) = each($in)) {
foreach ($v as $key => $val) {
if (!is_array($val)) {
$in[$k][$key] = stripslashes($val);
continue;
}
$in[] =& $in[$k][$key];
}
}
unset($in);
}
?>
|
Add to del.icio.us 
Can you digg it?
Linear Mode
