Enabling and disabling the PHP magic quotes directive

The magic_quotes directive in PHP automatically escapes special characters (like quotes) in incoming data from forms, cookies, and URLs. While this was intended to help prevent SQL injection, it often caused unexpected behavior and was deprecated in PHP 5.3 and removed entirely in PHP 5.4 and later.

Important Notes

• magic_quotes is not available in PHP 5.4 and newer versions.
• If you are running PHP 5.3 or earlier, you can still enable or disable it.
• Modern applications should use prepared statements and proper escaping instead of relying on magic_quotes.

How to Enable or Disable magic_quotes

1. Using a Custom php.ini File

Edit or create a php.ini file in your application directory:

; Enable magic quotes
magic_quotes_gpc = On

; Disable magic quotes
magic_quotes_gpc = Off

2. Using .htaccess

On Apache servers, you can override the directive in .htaccess:

# Enable
php_flag magic_quotes_gpc On

# Disable
php_flag magic_quotes_gpc Off

3. Using .user.ini

If your hosting environment supports .user.ini, add:

magic_quotes_gpc = Off

Best Practices

• Always keep magic_quotes disabled in modern PHP versions.
• Use parameterized queries (PDO or MySQLi) for database interactions.
• Avoid relying on automatic escaping, as it can break applications and cause double‑escaping issues.