Magic Quotes

[A_B_]

What are the disadvantages of turning off magic quote? I just did that on my server and now MySQL scripts run correctly. However I’m wondering if this will screw up something else.

Could someone explain why it’s needed in the first place?

Also what’s the best way to write scripts that handles MySQL correctly with magic quotes on? Some code to include in eh script perhaps? Anyone?

Thanks

[zmola]

magic_quotes escapes 'bad' chars, especially for db entry: \ ' " NUL

without escaping these, someone could mess with your database. magic_quotes aren't necessary. you can use addslashes instead.

if (!get_magic_quotes_gpc()) {
// if (!get_magic_quotes_runtime()) {
$foo = addslashes($foo);
}

perhaps read this: http://www.phpbuilder.com/board/showthread.php?s=&threadid=10213819

[A_B_]

Yes, that thread was helpful, Thanks.

I’ll turn magic quotes back on and modify my scripts using the methods described in that thread. But just to know, how dangerous is it to leave it off? What damage can happen really if I keep it off?

Thanks again

[zmola]

the danger is not in leaving magic_quotes off; the danger is in failing to properly escape (and validate) user input before inserting it into your db. you can escape 'bad' chars using magic_quotes or addslashes or mysql_escape_string.

if you do not properly escape 'bad' chars before dumping user input into your db, then someone entering badness in say a form field could possibly seriously compromise your db. you might want to read this too: http://www.phpbuilder.com/columns/sporty20001102.php3