Search code examples
phpmagic-quotes

which one will be better to use default magic quotes or user defined addslash/stripslash in PHP?

which one will be better to use default magic quotes or user defined addslash/stripslash in PHP? I want use the best one. please help me.

Solution

  • neither.

    magic quotes is the root of all evil! (in my eyes even worse than premature optimization xD)

    and why do you want to create a user defined (add|strip)slashes function, when there are native php ones?

    if you want to escape your date for a database use the database specific functions (e.g. mysqli_real_escape_string)

    EDIT. to complete my answer (after debating with sadi in the comments):

    • if you want to display/output some input, use htmlspecialchars

    • if you’re going to use your input in an URL, use urlencode

    so, there is no best or correct single way to encode your data. you have to use the right functions in the right place at the right time. each has its own purpose (see here: http://xkcd.com/163/)