Wicked Cool PHP

#15: Enabling Magic Quotes

Magic Quotes is a handy utility used by server hosts to protect against SQL Injection Attacks (as shown in "#19: SQL Injection Attacks " on Recommended Security Configuration Options). The idea is that whenever a form passes a variable to a PHP script, Magic Quotes automatically escapes all single quotes, double quotes, and backslashes with a backslash, turning "Ferrett's Book" into \"Ferrett\'s Book\".

If you're using MySQL, this isn't an ideal solution—you should use the MySQL-tailored mysql_real_escape_string() function instead—but in a pinch, Magic Quotes will do. Here's how to enable it in your php.ini file:

magic_quotes_gpc = 1

What Can Go Wrong?

If you don't have Magic Quotes turned on, you'll have to use the ...