|
|
|
|
![]() ![]() |
Feb 2 2008, 01:53 AM
Post
#1
|
|
|
Newbie [Level 3] ![]() ![]() ![]() Group: [HOSTED] Posts: 48 Joined: 21-January 08 Member No.: 56,591 |
my php configuration has magic_quotes_runtime set to off
so, when i pull a string out of a mysql db, how come it shows up just fine without running it through addslashes()? when i run it through addslashes(), it adds slashes where its supposed to.... but when i don't use it it shows up just fine i am curious as to why i dont have to run addslashes() to make my text show up right can anyone answer my question? |
|
|
|
Feb 2 2008, 02:42 AM
Post
#2
|
|
|
A computer once beat me at chess, but it was no match for me at kick boxing. ![]() Group: [MODERATOR] Posts: 4,002 Joined: 24-July 05 From: In Trouble Again... still? Member No.: 9,787 ![]() |
Magic_quotes function adds slashes to strings going to a Database. If it is set 'off', then the Database does not contain the escapes "\", so they won't be there when you return the data.
Magic_quotes is deprecated in php6. http://ca.php.net/manual/en/ref.info.php#i...-quotes-runtime |
|
|
|
Feb 2 2008, 04:10 AM
Post
#3
|
|
|
Ephesians 6:10-17 ![]() Group: [MODERATOR] Posts: 1,893 Joined: 22-June 05 From: The World of Gentoo Member No.: 8,528 ![]() |
Whenever you pull something out of your database that has slashes added to it, always strip the slashes using the stripslashes() function. It is better for you to add slashes to any input that's going into the database for security reasons. But it's better to use the mysql_real_escape_string() function than addslashes().
|
|
|
|
![]() ![]() |
Similar Topics
|
Lo-Fi Version | Time is now: 7th September 2008 - 01:18 PM |