Home/ Questions/Q 157677
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T10:32:48+00:00

When I send );– from an input field to my localhost PHP server, it

  • 0

When I send ');-- from an input field to my localhost PHP server, it AUTOMATICALLY converts it to

\’);–

It seems great, except that I don’t know how trustworthy this behavior is. Although it seems to avoid SQL injections, my development environment is not the same as the production environment and I’m afraid that the production environment may not have this sort of protection automatically activated…

Why does PHP does this(convert the input without having to use mysql_real_escape_string)? Does it always do it or only with certain extensions? Is it safe to rely on this behavior to prevent SQL injections?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. It seems that you have Magic Quotes enabled. But you better disable this option or revert them. mysql_real_escape_string is more secure.

    • 0