1

I'm using PDO prepared statements to insert data into a MySQL database, and I notice that apostrophes (single quotes) in strings are being stored in the database with back-slashes (\) preceding them.

I use stripslashes($string) on output, and of course this gets rid of them.

I searched my server's phpinfo() information (PHP version 5.2.17) for "magic_quotes" and found:

  • magic_quotes_gpc: local value = on, master value = on
  • magic_quotes_runtime: local value = off, master value = off
  • magic_quotes_sybase: local value = off, master value = off

Firstly, would turning magic_quotes_gpc off prevent the occurrence of the back-slashes? I don't currently have access to the server php.ini master settings, but as I understand it I would be able to disable it by configuring the root .htaccess file with the directive php_flag magic_quotes_gpc Off.

Secondly, is the prevention of these back-slashes in the database desirable? I ask this because I saw the somewhat cryptic remark here to "think twice before you do".

4

1 回答 1

2

关闭magic_quotes_gpc 会阻止反斜杠的出现吗？

大概是。

在数据库中防止这些反斜杠是否可取？

是的。他们没有任何目的。如果您使用 PDO 和适当的参数化查询，那么魔术引号用来解决的问题已经解决了。

请参阅有关魔术引号的 PHP 手册，了解为什么使用它们，以及为什么不应再使用它们。

于 2012-06-18T09:00:00.920 回答