GPC comes from GET/POST/COOKIE, and it refers to the source of the variable.
If this setting is on, any data that obtained from a get or post method, or from a cookie is by "magic" escaped(meaning that you don't have to use addslashes on the variable), thus making the variable safe for inserting it into a database.
If you want to know more about addslashes(), look at the manual page.