PHP Magic Quotes

PHP Magic Quotes

Prior to PHP 6 there was a feature called magic quotes that was created to help protect newbie programmers from writing bad form processing code. Magic quotes would automatically escape risky form data that might be used for SQL Injection with a backslash.

However, this newbie protection proved to cause more problems than it solved and is not in PHP 6. If your PHP version is any version before 6 then you should use this lesson to learn more about how magic quotes can affect you.

Magic Quotes Are They Enabled

First things first, you need to check to see if you have magic quotes enabled on you server. The get_magic_quotes_gpc function will return a 0 (off) or a 1 (on). These boolean values will fit nicely into an if statement where 1 is true and 0 is false.

if(get_magic_quotes_gpc())

    echo "Magic quotes are enabled";

else

    echo "Magic quotes are disabled";

 

If you received the message "Magic quotes are enabled" then you should definitely continue reading this lesson, if not feel free to learn about it in case you are developing for servers that might have quotes on or off.

Magic Quotes in Action

Now lets make a simple form processor to show how machines with magic quotes enabled will escape those potentially risky characters. This form submits to itself, so you only need to make one file, "magic-quotes.php" to test it out.

<?php

echo "Altered Text: ".$_POST['question'];

?>



<form method='post'>

Question: <input type='text' name='question'/><br />

<input type='submit'>



</form>

 

Removing Backslashes stripslashes

Before you use PHP's backslash removal function stripslashes it's smart to add some magic quote checking like our "Are They Enabled?" section above. This way you won't accidentally be removing slashes that are legitimate in the future if your PHP's magic quotes setting changes in the future.

<?php

echo "Removed Slashes: ";

// Remove those slashes

if(get_magic_quotes_gpc())

    echo stripslashes($_POST['question']);

else

    echo $_POST['question'];

    

?>



<form method='post'>

Question: <input type='text' name='question'/><br />

<input type='submit'>



</form>