should i use addslashes

bough

Hello

I am inserting data into my database, and my PHP is currently setup with magic quotes set to ON, so that it automatically escapes slashes.

I am interested to know the proper use of addslashes. I am now thinking of passing the data uploaded to my database through the addslashes and stripslashes functions to make sure that my code will work on another installation of PHP with magic quotes set to OFF.

Is it worth my time adding in the addslashes function to aid in portability to other systems, and also if i did use it would it add slashes twice when magic quotes is set to ON as well. Should I check if Magic quotes is set to ON and only use the addsalshes function if it is OFF

I hope that this makes somse sense

Thanks
Ian

Plasma

No need to use addslashes if its already escaped, and yeah, it would addslashes twice (resulting in a literal slash in your data) when being inserted in a query.

Shrike

It's bad to rely on magic quotes since it doesn't do the best job, slashing things which don't need it.

I'd suggest checking whether magic quotes is enabled...if it is then use stripslashes() and *_real_escape_string() (depending on database) on any string values.

bough

Thanks for the reponse.

I will proberbly write a short function to check for magic quotes and use add slashes if required.

jazz_snob

I think Shrike idea is a good one. Its what I do.

MarkR

Your best bet is to:

Check if magic quotes is on, and if it is, cause the application to quit immediately with a suitable error message
Never use addslashes(), instead use the appropriate database escaping function for your database - for example, mysql_real_escape_string
Never use stripslashes() - it's an indication that you've got something wrong.

magic_quotes_gpc is annoying - there's no point in trying to work around it. magic_quotes_runtime is intolerable - it's more-or-less impossible to work around it.

Mark