Why use mysql_real_escape_string () since $ _POST automatically adds slashes before the quote?

Question

In PHP, $ _POST adds slashes before the quote automatically, so why bother using mysql_real_escape_string ()? For example, when I 'rrrtyped in the input field, and I get \'rrrwhen I echo it.

Answer 1

Because this only happens if MacigQuotes is included in your php configuration, which, as far as I know, is quite rare at the present time. In addition, mysql_real_escape_string also avoids other MySQL related characters.

http://php.net/manual/en/security.magicquotes.php .

, , ^^

: , xampp php.ini , , :

; Magic quotes
;

; Magic quotes for incoming GET/POST/Cookie data.
magic_quotes_gpc = Off

; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.
magic_quotes_runtime = Off

; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = Off

Answer 2

• mysql_real_escape_string , , .
• PHP POSTed-, magic_quotes, ( , real_escape_string!)

Answer 3

PHP 5.3.0 PHP 6.0.

: , PHP .