Re: Security of magic_quotes_gpc under PHP against SQL injection

[Stefano Di Paola <stefano.dipaola () wisec it>]

There's a way to bypass magic_quotes_gpc if your input is urldecoded by 
urldecode($_GET['input']) function on some point of your script.

infact 

url?input=%2527 

becomes inside your script $_GET['input']=%27 which is not backslashed
because php doesnt normalize  encoding.
Then  urldecode(%27)='

so magic quotes could be bypassed if urldecode is applied to input vars.
(php 4.4.1)

And, yes mysql_real_escape_string could be the good one but it always
depends on how and when your input is manipulated by other functions.

Regards 

Stefano 



 
-- 

......---oOOo--------oOOo---......
Stefano Di Paola
Software Engineer
Email: stefano.dipaola_at_wisec.it
Email: stefano.dipaola1_at_tin.it
Web: www.wisec.it
..................................