what are magic quotes in php

What are magic quotes:

Magic quotes are used by the program to automatically convert the data entering the PHP script process. When turned on, all ' (single quote), " (double quote), \ (backslash) and NULL characters will be automatically escaped with a backslash. It has the same effect as the addslashes() function.

Magic quote directive:

magic_quotes_gpc affects HTTP request data (GET, POST and COOKIE). Cannot be changed at runtime. The default value in PHP is on. See get_magic_quotes_gpc().

magic_quotes_runtime If turned on, most functions that retrieve and return data from external sources, including databases and text files, will return backslash-escaped data. This option Can be changed at runtime, the default value in PHP is off. See set_magic_quotes_runtime() and get_magic_quotes_runtime().

magic_quotes_sybase If turned on, single quotes will be used to escape single quotes rather than reverse them. Slash. This option will completely override magic_quotes_gpc. If both options are turned on at the same time, single quotes will be escaped into ''. Double quotes, backslashes and NULL characters will not be escaped. How to get its value See ini_get().

The role of magic quotes:

The original introduction of magic quotes was a security consideration to prevent SQL injection. It can help PHP newbies unknowingly Relatively safer code is written in the code, but today, programmers are already well aware of this security issue, and eventually use the database transfer mechanism or prepared statements to replace the magic quotation mark function.

Magic Quotation mark defects:

Portability: When programming, it is considered that opening or closing them will affect portability. You can use get_magic_quotes_gpc() to check whether it is opened and program accordingly.

Performance: Since not every piece of escaped data must be inserted into the database, if all the data entering PHP is escaped, it will have a certain impact on the execution efficiency of the program. Call the escape function at runtime (such as addslashes()) is more efficient. Although php.ini-dist turns this option on by default, php.ini-recommended turns it off by default, mainly for performance reasons.

Inconvenience: Since not all data needs to be escaped, it is annoying to see escaped data in places that do not need to be escaped. For example, if you send an email through a form, you will see a lot of \'. To solve this problem, you can use stripslashes () function processing.

Switch magic quotes:

magic_quotes_gpc cannot be set through ini_set(). There are three ways to set magic_quotes_gpc.

1. Modify the PHP configuration file php.ini. This method requires administrative rights on the server to modify it. If it is just a virtual space, you can only use the latter two methods.

; Magic quotes ; Magic quotes for incoming GET/POST/Cookie data. magic_quotes_gpc = Off ; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. magic_quotes_runtime = Off Use Sybase-style magic quotes (escape ' with '' instead of \'). Magic_quotes_sybase = Off

2. Set in htaccess. This can only be used if the server supports htaccess.

php_flag magic_quotes_gpc Off

3. Shield in the code. This method is more portable, but has the lowest efficiency, so it is best to turn off magic_quotes_gpc by modifying the configuration article when you have server management rights.

Example code:

Summary:

Magic quotes were originally introduced to prevent SQL injection, which is beneficial to developers. Friend, but it also brings a lot of inconvenience when using it. Now there are more and better alternatives, so if you are still developing in php 5.3.0 or a version before php 5.3.0, you should try to avoid using magic quotes. , has been removed since PHP 5.4.0.

The above is the detailed content of what are magic quotes in php. For more information, please follow other related articles on the PHP Chinese website!