Setting the PHP magic quotes directive in an .htaccess file

The magic_quotes directive in PHP automatically escapes special characters (like quotes) in incoming data from forms, cookies, and URLs. While it was originally intended to help prevent SQL injection, it often caused unexpected behavior and was deprecated in PHP 5.3 and removed entirely in PHP 5.4 and later.

Important Notes

• magic_quotes is not available in PHP 5.4 and newer versions.
• If you are running PHP 5.3 or earlier, you can still enable or disable it.
• Modern applications should use prepared statements and proper escaping instead of relying on magic_quotes.

Steps to Configure magic_quotes in .htaccess

Step 1: Access Your Hosting Account

• Log in to cPanel or use FTP/File Manager.
• Navigate to your site’s root directory (e.g., /public_html).

Step 2: Create or Edit .htaccess

1. If .htaccess already exists, open it for editing.
2. If not, create a new file named .htaccess.

Step 3: Add the Directive

Insert one of the following lines depending on your needs:

# Enable magic quotes (not recommended)
php_flag magic_quotes_gpc On

# Disable magic quotes (recommended)
php_flag magic_quotes_gpc Off

Step 4: Save and Verify

1. Save the .htaccess file.

2. Create a test file info.php with:

   <?php phpinfo(); ?>

3. Load it in your browser and search for magic_quotes_gpc.

4. Confirm whether it is enabled or disabled.

5. Delete the test file afterward for security.

Best Practices

• Always keep magic_quotes disabled in modern PHP versions.
• Use parameterized queries (PDO or MySQLi) for database interactions.
• Avoid relying on automatic escaping, as it can break applications and cause double‑escaping issues.