I've got legacy PHP code which attempts to prevent script/SQL injection with the following:

if (!empty($_POST)) {
    while (list($k,$v)=each($_POST)) {

            if (!get_magic_quotes_gpc())


The same is exactly replicated for $_GET as well.

Is this enough to prevent script/SQL injection?

1 Answer 1


No. It's blacklist-based, it tries to take care of specific tricks involving html entities. It doesn't even require magic_quotes, and magic_quotes has been deprecated as inadequate. Chris Shiflett is just one of many who've written a blog post explaining how vulnerable that is; it won't even stop modern automated script-kiddie attacks.

Use prepared statements in the database, and you'll be most of the way there--although even prepared statements aren't foolproof.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .