kill_magic_quotes

small security question:

What is function kill_magic_quotes in manager/includes/quotes_stripper.inc.php for?
Why do you want to get rid of those slashes?

magic_quotes_gpc ON is another good think against SQL injection and if you want to insert gpc into a database you have to quote it anyway. So is there a need for that function?

magic_quotes wasn’t a very good idea from the PHP guys. How many times do you just save the data that gets submitted?

And one funny thing: magic_quotes quotes in a non-standard (according to SQL) way.

Quote from: stesch at Apr 11, 2006, 12:28 PM

And one funny thing: magic_quotes quotes in a non-standard (according to SQL) way.

MySql does too, so that isn’t the problem.

And the "real" problem with magic_quotes isn’t that the values are escaped, it’s that you never can depend on the values being escaped. So you’ll have to check it every time a value from a super global is retreived. Then again, you can also make sure wheter or not you can depend on the values being escaped (that’s what kill_magic_quotes does) so you only have to check once.

Summary: magic_quotes isn’t the evilness, making magic_quotes a php.ini setting is.