Question

I have the following select statement:

$res = mysql_query("select * from Table where Name='{$_REQUEST['name']}'");

However, since this kind of query is prone to SQL injection, I am using a more secured way for the selection:

$escaped_name=mysql_real_escape_string($_REQUEST['name']);
$res = mysql_query("select * from Table where Name='{$escaped_name}'");

It all works fine until I try to run the selection with a $_REQUEST['name'] that contains the string Joel's .In that case the selection doesn’t work. After debugging and printing the content of $escaped_name to the screen, I got the following:

Joel\\\'s

What is the reason for this? It seems like the string was escaped automatically, and then I escaped it again.

Answer 1

The data was probably auto-escaped by PHP’s (deprecated) "magic quotes" feature. To disable magic quotes in .htaccess:

php_flag magic_quotes_gpc off
php_flag magic_quotes_runtime off