PHP转义查询字符串变量(PHP Escaping query string variables)

PHP转义查询字符串变量(PHP Escaping query string variables)

我在我的Web应用程序中创建了一个只有单个文本字段的表单，并且该字段使用GET发布到PHP页面，但我正在观察奇怪的行为。 即当我在我的本地服务器上测试它时，收到的文本是在文本字段中写入的，但是当我将它上载到我的在线服务器时，收到的字符串会自动转义，意味着所有单引号和双引号都会被转义。 例如，如果我写It's not true...那么在PHP方面，我会得到

$comment = $_REQUEST["comm"]; print $comment; //will print It\'s not true... on my online server //will print It's not true... on my local server

我仍然无法忍受为什么这样呢？ 是否有任何PHP设置自动转义查询字符串变量？

I have created a form in my web application which has only a single text field and that field is posted to a PHP page using GET, but I am observing strange behavior. i.e. when I test it on my local server, the text is received as it was written in the text field, but when I upload it to my online server, the received string is escaped automatically means, all single quotes and double quotes are escaped. e.g. If I write It's not true... then on php side I will get

$comment = $_REQUEST["comm"]; print $comment; //will print It\'s not true... on my online server //will print It's not true... on my local server

I am yet unable to under stand why is it so? Is there any PHP setting for escaping Query Strings variables automatically?

最满意答案

你启用了“魔术引号”。 它们是一个可怕的错误，幸运的是在下一个版本的PHP中被删除。 PHP手册有一个禁用它们的指南 。

总之，您需要在php.ini文件中将以下配置项目设置为Off ：

magic_quotes_gpc的 magic_quotes_runtime的 magic_quotes_sybase

具体而言，您的问题似乎是magic_quotes_gpc - “gpc”部分是“ GET ，POST和COOKIE”的简称 - 但最好禁用所有这些部分。

You have "magic quotes" enabled. They're a terrible misfeature which are luckily being removed in the next version of PHP. The PHP manual has a guide to disabling them.

In short, you need to set the following configuration items to Off in your php.ini file:

magic_quotes_gpc magic_quotes_runtime magic_quotes_sybase

Specifically, your problem appears to be with magic_quotes_gpc - the "gpc" portion being short for "GET, POST, and COOKIE" - but it's good practice to keep all of them disabled.