Home/ Questions/Q 3358890
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-18T02:48:22+00:00

I have the following select statement: $res = mysql_query(select * from Table where Name='{$_REQUEST[‘name’]}’);

  • 0

I have the following select statement:

$res = mysql_query("select * from Table where Name='{$_REQUEST['name']}'");

However, since this kind of query is prone to SQL injection, I am using a more secured way for the selection:

$escaped_name=mysql_real_escape_string($_REQUEST['name']);
$res = mysql_query("select * from Table where Name='{$escaped_name}'");

It all works fine until I try to run the selection with a $_REQUEST['name'] that contains the string Joel's .In that case the selection doesn’t work. After debugging and printing the content of $escaped_name to the screen, I got the following:

Joel\\\'s

What is the reason for this? It seems like the string was escaped automatically, and then I escaped it again.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The data was probably auto-escaped by PHP’s (deprecated) "magic quotes" feature. To disable magic quotes in .htaccess:

    php_flag magic_quotes_gpc off
php_flag magic_quotes_runtime off
    • 0