Posted by Oli Filth on 05/28/05 21:13

Dave Moore said the following on 28/05/2005 18:44:
> Hi All,
> Can anybody point me to a FAQ or similar that describes what all this
> stuff is about please?. I'm interfacing with a MySQL database if that's
> relavent. I've read a couple of books which refer to stripslahes and
> 'escaping' but nothing really explains what these terms are and why these
> are used. Why is 'escaping' (whatever that is) used?. What the hell is a
> magic quote?. How is it different from a non-magic one?.
>

Imagine you're putting some data into a MySQL database. You might do
something like:

mysql_query("INSERT INTO table (name) VALUES ('$name')");

where $name is a string.
If $name was "John", the query string would become:

INSERT INTO table (name) VALUES ('John')

No problem there. But if $name was "Hell's Bells", then the string becomes:

INSERT INTO table (name) VALUES ('Hell's Bells')

Now, there's a mismatch in the number of single quotes, and this will
cause a MySQL error.

To get around this, one indicates a single-quote *within* a value string
using \' i.e backslash, single-quote. This is called "escaping" (one
escapes from the syntax processing that would normally occur).

All strings must be "escaped" before being put into an SQL query using
mysql_real_escape_string(), which does the conversion above (as well as
a few others). So your command would be:

mysql_query("INSERT INTO table (name) VALUES ('"
. mysql_real_escape_string($name) . "')");


Magic Quotes is something that seemed like a good idea back in the
earlier days of PHP. Basically, when Magic Quotes is turned on, all GET,
POST and COOKIE variables are automatically escaped ready for use in a
database query. This is to save lazy people time, so that they don't
have to call mysql_real_escape_string() each time.

However, they *will* have to call stripslashes() (which removes the
escaping from the string) whenever they want to use the string in a
normal context. So it's actually just a pain. If you have control of
your PHP configuration, turn magic-quotes off.

If not, you'll have to do something like at the top of your scripts:

if (get_magic_quotes_gpc())
{
foreach ($_GET as $key=>$value)
{
$_GET["key"] = stripslashes($value);
}
}


P.S. The best place to start on reading about anything PHP-related is
the online manual: http://www.php.net/manual.

--
Oli

[Back to original message]