You should NEVER rely on magic quotes or addslashes for security in an SQL context. You should ALWAYS use proper escape functions, such as mysql_real_escape_string. Failure to do so may result in an SQL injection vulnerability.
(PHP 4, PHP 5)
set_magic_quotes_runtime — Sets the current active configuration setting of magic_quotes_runtime
This function was DEPRECATED in PHP 5.3.0, and REMOVED as of PHP 7.0.0.
$new_setting
)Set the current active configuration setting of magic_quotes_runtime.
Since PHP 5.3 this function has been deprecated and will raise an E_DEPRECATED warning upon execution. Since PHP 5.4 this function will also raise an E_CORE_ERROR on trying to enable magic quotes.
new_setting
FALSE for off, TRUE for on.
Returns TRUE on success or FALSE on failure.
Example #1 set_magic_quotes_runtime() example
<?php
// Create a temporary file pointer
$fp = tmpfile();
// Write some data to the pointer
fwrite($fp, '\'PHP\' is a Recursive acronym');
// Without magic_quotes_runtime
rewind($fp);
set_magic_quotes_runtime(false);
echo 'Without magic_quotes_runtime: ' . fread($fp, 64), PHP_EOL;
// With magic_quotes_runtime
rewind($fp);
set_magic_quotes_runtime(true);
echo 'With magic_quotes_runtime: ' . fread($fp, 64), PHP_EOL;
// Clean up
fclose($fp);
?>
The above example will output:
Without magic_quotes_runtime: 'PHP' is a Recursive acronym With magic_quotes_runtime: \'PHP\' is a Recursive acronym
You should NEVER rely on magic quotes or addslashes for security in an SQL context. You should ALWAYS use proper escape functions, such as mysql_real_escape_string. Failure to do so may result in an SQL injection vulnerability.
Be aware that even using ini_set to set 'magic_quotes_runtime' will stop working in PHP 5.4. See http://php.net/manual/en/info.configuration.php#ini.magic-quotes-runtime
A simple check and disabling of magic quotes whenever needed (e.g. if you deploy to multiple servers or you don't know the target server's PHP version).
<?php
if(version_compare(PHP_VERSION, '5.3.0', '<')){
set_magic_quotes_runtime(0);
}
?>
get_magic_quotes runtime and set_magic_quotes_runtime are useful when you want to read some data in a binary file using fread() and some bytes in such file may be interpreted as \ (backslash), " (double quotes), ' (simple quote) or any "special" character that has a meaning for string processing.
Since this function is depracted as of PHP 5.3, use ini_set('magic_quotes_runtime', 0); instead.