does php latest version add slash by default??

Question

when i write

input data: hel'l"lo

print_r($_POST) display hel\'\"lo

and when i use

if(get_magic_quotes_gpc()){ 
    mysql_real_escape_string($_POST); 

display

hel\\\'\\\"lo

now my quetion is that "is it necessary to use mysql_real_escape_string? bcoz i think php automaticaaly add slashes in post varaiable?"

Answer 1

magic_quotes_gpc is deprecated option at php 5.3

Answer 2

No, from version 5.3 onwards, there will be no slashes added by default.

Answer 3

is it necessary to use mysql_real_escape_string?

Yes. But not as a blanket encoding over $_POST or $_GET. That's applying an output-stage escaping mechanism to the input stage, which is the wrong thing and will mangle your strings in unexpected and unwanted ways.

You should keep your strings in raw form up until the moment you insert the string into another context. At that point only, you use the appropriate escaping function. With MySQL:

$query= "SELECT * FROM items WHERE title='"+mysql_real_escape_string($_POST['title'])+"'";

or with HTML:

<p>Title: <?php echo(htmlspecialchars($_POST['title'])) ?></p>