This page [1] seems to indicate that using magic_quotes_gpc can be “somewhat secure” as long as one does not use the GBK character set and as long as the query parameters are properly quoted.
Does anyone know of an exploit that can SQL inject despite the presence of magic_quotes_gpc and properly quoted queries?
P.S. I’m well aware that best practice is to use prepared queries and to turn magic_quotes_gpc off. I’d prefer to back up my recommendation with an exploit if possible. ;-)
[1] http://www.hakipedia.com/index.php/SQL_Injection#addslashes.28.29_.26_magic_quotes_gpc
David Alan Hjelle
1 Corinthians 2:2
http://thehjellejar.com/
Check out Rita’s spoons.
This page [1] seems to indicate that using magic_quotes_gpc can be “somewhat secure” as long as one does not use the GBK character set and as long as the query parameters are properly quoted.
Does anyone know of an exploit that can SQL inject despite the presence of magic_quotes_gpc and properly quoted queries?
P.S. I’m well aware that best practice is to use prepared queries and to turn magic_quotes_gpc off. I’d prefer to back up my recommendation with an exploit if possible. ;-)
[1] http://www.hakipedia.com/index.php/SQL_Injection#addslashes.28.29_.26_magic_quotes_gpc
David Alan Hjelle
1 Corinthians 2:2
http://thehjellejar.com/
Check out Rita’s spoons.
