# Too many "\\" in my database **URL:** \ **Category:** programming\ **Created:** [July 13, 2008, 9:22pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863 "2008-07-13T21:22:22Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![NeoDreamer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@NeoDreamer](https://forum.kirupa.com/u/NeoDreamer)\ **Post date:** [July 13, 2008, 9:22pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/1 "2008-07-13T21:22:22Z")
Every time, I insert text with quotes into my MySQL database, a “” is placed before each quote. And each time that entry is edited, the number of “” doubles, because not only does it need to escape quotes, but also the existing “” too. When updating entries with PHP, is there a way to not have like 500 “” inserted? I only need the bare minimum of escaping to protect against MySQL injection attacks, but 500 pairs of them is just overkill. ---
**Author:** ![Voetsjoeba](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@Voetsjoeba](https://forum.kirupa.com/u/Voetsjoeba)\ **Post date:** [July 13, 2008, 9:37pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/2 "2008-07-13T21:37:06Z")
Check if PHP’s [magic\_quotes](http://www.php.net/manual/en/function.get-magic-quotes-gpc.php) directive is activated. That’s probably messing with your incoming $\_POST and/or $\_GET data. Check with your host to see if you can deactivate it, and if not you can still manually apply stripslashes to $\_POST, $\_GET and $\_COOKIE at the beginning of your script to cancel it out. ---
**Author:** ![NeoDreamer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@NeoDreamer](https://forum.kirupa.com/u/NeoDreamer)\ **Post date:** [July 13, 2008, 9:58pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/3 "2008-07-13T21:58:58Z")
If I turn off magic\_quotes, will my database be susceptible to SQL injection attacks? ---
**Author:** ![sekasi](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@sekasi](https://forum.kirupa.com/u/sekasi)\ **Post date:** [July 13, 2008, 10:20pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/4 "2008-07-13T22:20:08Z")
No, like voetsjoeba said you still need to manually do safe quotes and such on post/get/cookie but magic\_quotes is a really weird functionality that came during an era of a lot of security problems. In general it will cause a decent to great developer a lot of headache but it might save a bad one. ---
**Author:** ![Voetsjoeba](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@Voetsjoeba](https://forum.kirupa.com/u/Voetsjoeba)\ **Post date:** [July 14, 2008, 1:08am UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/5 "2008-07-14T01:08:19Z")
The thing about magic\_quotes is that it was originally introduced as a means of automatically preventing SQL injections (mostly) for novice PHP users who had no idea of the security implications of directly injecting user input into queries. They would do things like ```php mysql_query("DELETE FROM table WHERE name = '".$_GET['name']."'"); ``` and not realize what’s wrong with that (and sadly to this day I still see this happen surprisingly much). This is part of the reason why PHP used to have the reputation of being “insecure”, when really the only reason was the people using PHP failing to understand the need for proper user input filtering. Here’s where magic\_quotes comes in to provide a failsafe by automatically applying [addslashes](http://www.php.net/manual/en/function.addslashes.php) to all get/post/cookie data before even making them available to the script. That way, when the $\_GET/$\_POST data gets inserted into the query as above, it’s already escaped. Unfortunately, for people who actually know what they’re doing and knowingly apply mysql\_real\_escape\_string to all user-input data before inserting them into their queries, this causes the data to be escaped twice and thus wrong values to be entered into the database. Because magic\_quotes is applied before the actual script begins executing, there’s no way of turning it off from inside the script itself. A standard solution is to [recursively apply [URL=“http://www.php.net/manual/en/function.stripslashes.php”]stripslashes](http://www.php.net/manual/en/function.array-walk.php) to all $\_GET, $\_POST and $\_COOKIE data on every page load before the rest of your script is executed, of course wrapped inside an if(get\_magic\_quotes\_gpc()) to make sure you’re not overzealously stripping backslashes. Bottom line: make sure to always apply [mysql\_real\_escape\_string](http://www.php.net/manual/en/function.mysql-real-escape-string.php) (do not use addslashes instead!) to user-input data before inserting them into queries, and you’ll be safe from SQL injections. When dealing with backslash hell it’s often easy to lose track of things, so if you find yourself lost just remember that applying mysql\_real\_escape\_string to data before entering it into queries will ensure that the data is entered into the database exactly as it was fed to mysql\_real\_escape\_string. Think of mysql\_real\_escape\_string as a bodyguard that ensures that the data you feed it is transferred to the database safely and exactly as you handed it. What I’m saying is: never doubt mysql\_real\_escape\_string, and never doubt the need for it. ---
**Author:** ![simplistik](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/simplistik/32/7747_2.png) [@simplistik](https://forum.kirupa.com/u/simplistik)\ **Post date:** [July 14, 2008, 1:26pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/6 "2008-07-14T13:26:09Z")
wise man once told me, magic\_quotes is the devil, mysql\_real\_escape\_string is the way to go. I wonder who told me that [whisper]voets[/whisper] ---
**Author:** ![NeoDreamer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@NeoDreamer](https://forum.kirupa.com/u/NeoDreamer)\ **Post date:** [July 14, 2008, 8:52pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/7 "2008-07-14T20:52:57Z")
So I read about magic quotes. It seems to do the same thing as mysql\_real\_escape\_string, except it does it to EVERYTHING, not only the things you’re going to put in some SQL. Was my problem using mysql\_real\_escape\_string with magic quotes turned on? That would surely do double damage. What if I just leave magic quotes on and not use mysql\_real\_escape\_string? Will I still get this 500 “” thing? ---
**Author:** ![Voetsjoeba](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@Voetsjoeba](https://forum.kirupa.com/u/Voetsjoeba)\ **Post date:** [July 14, 2008, 9:54pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/8 "2008-07-14T21:54:49Z")
> [@NeoDreamer;2358555](#): > > So I read about magic quotes. It seems to do the same thing as mysql\_real\_escape\_string, except it does it to EVERYTHING, not only the things you’re going to put in some SQL. You’re right about magic\_quotes adding slashes to everything, but not about them doing the same thing. They might seem similar, but you must always use mysql\_real\_escape\_string when entering user-input data into queries. Probably the biggest reason why is that addslashes is completely oblivious of any character set other than ASCII. Under certain circumstances, this can enable attackers to bypass the effect of addslashes, which you don’t want. In contrast, mysql\_real\_escape\_string takes the current character set used by the connection to MySQL into account. Another reason is that addslashes does not escape everything mysql\_real\_escape\_string does. > [@NeoDreamer;2358555](#): > > Was my problem using mysql\_real\_escape\_string with magic quotes turned on? That’s probably what happened, yes. > [@NeoDreamer;2358555](#): > > What if I just leave magic quotes on and not use mysql\_real\_escape\_string? Will I still get this 500 "" thing? If the reason is indeed having both magic\_quotes and mysql\_real\_escape\_string applied, then removing either one should take care of the extra backslashes being generated. However, you really should get rid of magic\_quotes and stick with mysql\_real\_escape\_string for reasons explained above. ---
**Author:** ![NeoDreamer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@NeoDreamer](https://forum.kirupa.com/u/NeoDreamer)\ **Post date:** [July 14, 2008, 10:49pm UTC](https://forum.kirupa.com/t/too-many-in-my-database/265863/9 "2008-07-14T22:49:21Z")
I understand fully. Thanks for the great explanation.