Code Review Stack Exchange is a question and answer site for peer programmer code reviews. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to remove all magic quotes at the start of my PHP script (if they are turned on). The code I'm using to do this is rather simple, so I was wondering if I was overlooking anything:

if (get_magic_quotes_gpc())
    foreach ($_GET as $key => $value)
        $_GET[$key] = stripslashes($value);

    foreach ($_REQUEST as $key => $value)
        $_REQUEST[$key] = stripslashes($value);

    foreach ($_POST as $key => $value)
        $_POST[$key] = stripslashes($value);

    foreach ($_COOKIE as $key => $value)
        $_COOKIE[$key] = stripslashes($value);

Am I missing / overlooking anything? Thanks.

share|improve this question
up vote 1 down vote accepted

Magic Quotes are removed as of PHP 5.4. I would consider something like this only if you don't have control over the php.ini and only if you are on < 5.4.

Your code does not handle multi dimensional arrays nor array keys. See this stackoverflow answer for a better method of disabling magic quotes.

share|improve this answer

If you are sanitizing your input just for the sake of sanitizing your input, you're wasting time (both yours in coding and the computer in execution). Do you need to sanitize $_COOKIE if you never use it? What about $_SESSION?

Only sanitize what you need, when you need it. Switching to a PDO system to have it sanitize your database queries would solve that aspect (and the #1 reason to sanitize).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.