Successful SQL Injection despite PHP Magic Quotes

问题

I have always read that Magic Quotes do not stop SQL Injections at all but I am not able to understand why not! As an example, let's say we have the following query:

SELECT * FROM tablename
  WHERE email='$x';

Now, if the user input makes $x=' OR 1=1 --, the query would be:

SELECT * FROM tablename
  WHERE email='\' OR 1=1 --';

The backslash will be added by Magic Quotes with no damage done whatsoever!

Is there a way that I am not seeing where the user can bypass the Magic Quote insertions here?

回答1:

The trick is usually to pass a binary value so that the backslash would become a part of valid multibyte character. Here is a blog post about it.

来源：https://stackoverflow.com/questions/2735749/successful-sql-injection-despite-php-magic-quotes