Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!gegeweb.org!de-l.enfer-du-nord.net!feeder2.enfer-du-nord.net!feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Simon <bad@example.com>
Newsgroups: comp.lang.php
Subject: Re: magic_quotes_gpc() on or off?
Date: Wed, 11 May 2011 13:53:16 +0200
Lines: 23
Message-ID: <92vblcFsnvU2@mid.individual.net>
References: <92us45F6n8U1@mid.individual.net> <iqdpbt$bju$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-Trace: individual.net Fa0sNjP2SCbfwqrB4CzXOwEOioaen6rADJdcyuuxK6eP1KiXIC
Cancel-Lock: sha1:STnEApZomfSAaEHBaVBplss6vR4=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Thunderbird/3.1.10
In-Reply-To: <iqdpbt$bju$1@dont-email.me>
Xref: x330-a1.tempe.blueboxinc.net comp.lang.php:1514

>
> If $data really comes from GET/POST/COOKIE and the original value is
> «H\hi», you should have «H\\hi».

So you saying that stripslashes(...) should be called on GET/POST/COOKIE 
rather than on any data?

This certainly makes more sense to me, but the doc is not entirely clear 
about that, or I am just not reading it properly.

>
> Inspect its value with var_dump() and make sure it's actually coming
> from $_GET, $_POST or $_COOKIE.
>
> Also, have a look at the register_globals directive. If you rely on it,
> you can never be sure of where your variable comes from.
>
>

Will do, thanks

Simon