Is it necessary to use mysql_real_escape_string(), when magic_quotes_gpc is on?

Question

To prevent SQL injection, is it necessary to use mysql_real_escape_string(), when magic_quotes_gpc is on?

Answer 1

yes its good practice to run all values that are going into your sql statement through the filter mysql_real_escape_string() its not just quotes that the filter is fixing.

it prevents injection attacks, see the example on the php manual for the method.

http://php.net/manual/en/function.mysql-real-escape-string.php