Re: magic_quotes_gpc() on or off?

Path	csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!gegeweb.org!newsfeed.kamp.net!newsfeed0.kamp.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	Simon <bad@example.com>
Newsgroups	comp.lang.php
Subject	Re: magic_quotes_gpc() on or off?
Date	Wed, 11 May 2011 13:49:09 +0200
Lines	72
Message-ID	<92vbdmFsnvU1@mid.individual.net> (permalink)
References	<92us45F6n8U1@mid.individual.net> <iqdoum$tjv$1@dont-email.me>
Mime-Version	1.0
Content-Type	text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	individual.net S5OAhslNCaVqR6yX0bfKnAgPCeP6cxuZ6IkeYeO+SPQncTtv43
Cancel-Lock	sha1:ZGxRnKi/4Q9DYWn8XK3s0pOGv4Y=
User-Agent	Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Thunderbird/3.1.10
In-Reply-To	<iqdoum$tjv$1@dont-email.me>
Xref	x330-a1.tempe.blueboxinc.net comp.lang.php:1513

Show key headers only | View raw

On 5/11/2011 12:38 PM, Jerry Stuckle wrote:

>>
>> // get a proper MySQL connection for mysql_real_escape_string() to work.
>> ...
>> //
>> //
>> $data = 'H\hi'; // a random string that I want to save 'as is' in the
>> db. Note the 'escaped' character.
>>
>
> First of all, '\h' is not a valid escape character. If you actually want
> a backslash there, you need to use '\\h'. Using invalid character
> combinations leads to unpredictable results.

I never said I wanted to save \h as an escape character.
I want to save the string 'H\hi' as is, (as used in the date() function 
for example).

>
>> //
>> // now try and save it to the db
>> //
>> // Stripslashes if need be
>> if (get_magic_quotes_gpc())
>> {
>> $data = stripslashes($data);
>> }
>>
>
> Why are you stripping slashes BEFORE storing the data?
> magic_quotes_gpc() affects data RETRIEVED from the database.


As per my original post, this is what the doc suggests.

http://php.net/manual/en/function.mysql-real-escape-string.php

"If magic_quotes_gpc is enabled, first apply stripslashes() to the data. 
Using this function on data which has already been escaped will escape 
the data twice."

>
>> // escape
>> $data = mysql_real_escape_string($data);
>>
>> echo $data;
>> ////////////////////////////////////////////////////////////////////////////
>>
>>
>>
>> You will see that the data has become 'Hhi', the '\' has been stripped,
>> and the data is no longer saved as expected.
>>
>
> As I would expect, as indicated above.

As indicated in my previous post this is what the doc says.
Unless I misunderstood the doc.

>>
>
> I never run with magic_quotes_gpc() on, and won't recommend a host who
> runs with it on. If they don't know enough to turn off something which
> has been deprecated for years, I'm not sure what else they are clueless
> about.

That's beside the point, but I agree.

Thanks

Simon

Thread

magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 09:28 +0200
  Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-11 06:38 -0400
    Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 13:49 +0200
      Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-11 11:29 -0400
        Re: magic_quotes_gpc() on or off? Michael Fesser <netizen@gmx.de> - 2011-05-13 21:25 +0200
          Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-13 18:44 -0400
  Re: magic_quotes_gpc() on or off? "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2011-05-11 12:45 +0200
    Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 13:53 +0200
      Re: magic_quotes_gpc() on or off? "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2011-05-11 16:13 +0200
        Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 16:15 +0200

csiph-web