Additionally, addslashes() is not a cure-all against SQL injection attacks. You should use your database's dedicated escape function (such as mysql_escape_string) or better yet, use parameterised queries through mysqli->prepare().
为什么不用魔术引号
rjh at netcraft dot com
13-Jun-2007 09:50
Additionally, addslashes() is not a cure-all against SQL injection attacks. You should use your database's dedicated escape function (such as mysql_escape_string) or better yet, use parameterised queries through mysqli->prepare().
gerard at modusoperandi dot com dot au
14-May-2007 04:53
Apparently it will be removed in PHP 6:
11-Feb-2006 09:47
It is also important to disable Magic Quotes while in development enivronment. For the reasons mentioned above, not everybody is using Magic Quotes. | ||