PHP特區 : [教學]在PHP中，寫入SQL語法時，是不是怕碰到單引號（'）或是雙引號(")呢？

; Magic quotes for incoming GET/POST/Cookie data.
;magic_quotes_gpc = Off
;原本可能是Off低，把他改成像下面這樣On起來就好了！
magic_quotes_gpc = On

; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.
magic_quotes_runtime = Off

; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = Off

<?php
$str = "A 'quote' is <b>bold</b>";
echo htmlentities($str);
//這裡的輸出會是：「A 'quote' is <b>bold</b>」
echo htmlentities($str, ENT_QUOTES);
//如果單引號宇雙引號都處理的話，輸出會是：「A 'quote' is <b>bold</b>」
?> 

<?php
function escape($str){
    if(function_exists('mysql_escape_string')){
         return mysql_escape_string($str);
    }elseif( function_exists(...real_escape...)){
       //real_escape
    }else{
        if(MAGIC_QUOTER ....判斷){
             return $str
        }else{
            return addslashes($str);
        }
    }
}

if (!get_magic_quotes_gpc()) {
$lastname = addslashes($_POST[『lastname』]);
} else {
$lastname = $_POST[『lastname』];
}