Magic Quotes

[Lance(HAOH)]

I am using magic quotes to do my scripting.I really wonder,what magic quotes are really for?Some guides say they are for stripping backslashes out of codes.But what for?Could somebody please advise me on the uses of magic quotes?

[goughy000]

its for example............


You have a form with a text input...

The text input is called textinput and the form method is POST

In the php script that processes the data you have this code:

PHP Code:

<?php
mysql_query("SELECT * FROM `table` WHERE `type` = '" . $_POST['textinput'] . "'");
?>

Without magic quotes if someone was to put a ' in the text input the SQL query would get broken as it would get translated into this...

SELECT * FROM `table` WHERE `type` = 'something'somethingelse'

the ' would end the text string and SQL would get confused and the world would implode on itself.

With magic quotes turned on a \ is auto added before any quote marks so instead the SQL query would look like this

SELECT * FROM `table` WHERE `type` = 'something\'somethingelse'

and the world would be saved and SQL would be happy.

there are security concerns with this though so people often prefer to turn it off and handle the slashes thereselves.

[naftakjin]

(11-22-2008 09:53 AM)goughy000 Wrote:  there are security concerns with this though so people often prefer to turn it off and handle the slashes thereselves.

What bad could it do?

[darkfate]

(09-17-2009 02:02 PM)naftakjin Wrote:  

(11-22-2008 09:53 AM)goughy000 Wrote:  there are security concerns with this though so people often prefer to turn it off and handle the slashes thereselves.

What bad could it do?

It doesn't work as well as it theoretically should. It misses certain things and doesn't have the fine grained control like you would with your own function.

[goughy000]

as darkfate said the security issue is more with people assuming it will be doing everything and then not bothering to code any security checks in for themself.

[LaniValdez10]

Can I know what is all about that magic quotes? I am not too familiar to that words so I an asking to you this question. Can you??? if you don't mind... Please.. Thanks in advance,,


_________________
Indianapolis Dentist