backslashes

backslashes

Posted Jun 1, 2006 17:51 UTC (Thu) by rfunk (subscriber, #4054)
Parent article: SQL injection vulnerabilities in PostgreSQL

The article mentions that using backslashes as escape characters
exacerpates the problem. Unfortunately a major web-development language
(PHP) encourages using backslashes as escape characters, with its
addslashes() function and magic_quotes_gpc=on default.

The fact that these misfeatures may be deprecated or disrecommended now
doesn't help much, since there's so much old documentation and advice out
there, and so many PHP programmers who barely even understand what
they're copying let alone the concept of SQL injection or multibyte
characters.

---

(Log in to post comments)