It's easy to get confused in all the magic_quotes settings. Therefor, I used this script to clear things up a little. Hope it helps!
Note 1: Use a simple costumer database table with as costumer_id and a costumer_name, named costumer.
Note 2: You'll manually have to set magic_quotes_gpc in the php.ini, since it cannot be changed at runtime. Change it, restart your webserver, run again and see the difference. ;)
-----
<?php
function new_attempt() {
echo 'get_magic_quotes_gpc = ' . get_magic_quotes_gpc() . '<br>';
echo 'get_magic_quotes_runtime = ' . get_magic_quotes_runtime() . '<br>';
$userinput = $_POST['userinput'];
echo "userinput = $userinput<br>";
echo '<i>Update without addslashes</i><br>';
$sql = "update costumer set costumer_name = '$userinput' where costumer_id = 1";
echo "sql = $sql<br>";
echo 'mysql_query = ' . mysql_query ( $sql ) . '<br>';
echo '<i>Update with addslashes</i><br>';
$sql = "update costumer set costumer_name = '" . addslashes($userinput) . "' where costumer_id = 2";
echo "sql addslashes = $sql<br>";
echo 'mysql_query = ' . mysql_query ( $sql ) . '<br>';
echo '<i>Select without stripslashes 2</i><br>';
$sql = "select costumer_name from costumer where costumer_id = 2";
echo "sql = $sql<br>";
$resquery = mysql_query ( $sql );
echo 'mysql_query = ' . $resquery . '<br>';
$resfetch = mysql_fetch_array( $resquery );
echo 'mysql_fetch_array = ' . $resfetch . '<br>';
echo 'array[\'costumer_name\'] = ' . $resfetch['costumer_name'] . '<br>';
echo '<i>Select with stripslashes 2</i><br>';
$sql = "select costumer_name from costumer where costumer_id = 2";
echo "sql = $sql<br>";
$resquery = mysql_query ( $sql );
echo 'mysql_query = ' . $resquery . '<br>';
$resfetch = mysql_fetch_array( $resquery );
echo 'mysql_fetch_array = ' . $resfetch . '<br>';
echo 'array[\'costumer_name\'] stripslashes = ' . stripslashes($resfetch['costumer_name']) . '<br>';
}
?>
<html>
<head>
<title>slashes test</title>
</head>
<body>
<?php
if ( $_POST ) {
mysql_connect ( 'server' , 'user' , 'pass' );
mysql_select_db ( 'database' );
echo '<p><b>set_magic_quotes_runtime = 0</b><br>';
set_magic_quotes_runtime(0);
new_attempt();
echo '</p><p><b>set_magic_quotes_runtime = 1</b><br>';
set_magic_quotes_runtime(1);
new_attempt();
echo '</p>';
}
?>
<p> </p>
<form method="post" name="slashes_form" action="slashes.php">
<input type="text" name="userinput" value="<?=$_POST['userinput']?>"/>
<input type="submit" name="submit" value="test">
</form>
</body>
</html>
pfpro_version
