Magic Quotes — What They Were and Why Removed

Also Known As

TL;DR

Explanation

Magic quotes (magic_quotes_gpc) automatically ran addslashes() on all GET, POST, and COOKIE data. The intent was to prevent SQL injection, but the implementation was flawed: it escaped everything whether or not it reached a database, double-escaped already-escaped data, and gave false confidence. PHP 5.3 deprecated it, PHP 5.4 removed it. Code from this era often calls stripslashes() to undo the escaping — a reliable signal you are reading legacy PHP 3/4/5 code.

Common Misconception

Why It Matters

Common Mistakes

• Removing magic_quotes_gpc emulation without adding prepared statements
• Forgetting stripslashes() calls exist to undo magic quotes
• Assuming PHP 7+ apps inherited the escaping behaviour

Code Examples

// PHP 4/5 with magic_quotes_gpc=On:
$name = $_GET['name']; // "O\'Brien" — auto-escaped
mysql_query("SELECT * FROM users WHERE name='$name'");

// Modern PHP — explicit PDO parameterisation:
$stmt = $pdo->prepare('SELECT * FROM users WHERE name = ?');
$stmt->execute([$_GET['name'] ?? '']);
$users = $stmt->fetchAll();

References

• ↗ https://www.php.net/manual/en/security.magicquotes.php

Tags

Related Terms