{"action":"created","issue":{"url":"https://api.github.com/repos/ezSQL/ezSQL/issues/85","labels_url":"https://api.github.com/repos/ezSQL/ezSQL/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/ezSQL/ezSQL/issues/85/comments","events_url":"https://api.github.com/repos/ezSQL/ezSQL/issues/85/events","html_url":"https://github.com/ezSQL/ezSQL/issues/85","id":117828346,"number":85,"title":"ez_sql_mysql escape() function spoils strings with the slashes","user":{"login":"AndreyRa","id":4364366,"avatar_url":"https://avatars.githubusercontent.com/u/4364366?v=3","gravatar_id":"","url":"https://api.github.com/users/AndreyRa","html_url":"https://github.com/AndreyRa","followers_url":"https://api.github.com/users/AndreyRa/followers","following_url":"https://api.github.com/users/AndreyRa/following{/other_user}","gists_url":"https://api.github.com/users/AndreyRa/gists{/gist_id}","starred_url":"https://api.github.com/users/AndreyRa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndreyRa/subscriptions","organizations_url":"https://api.github.com/users/AndreyRa/orgs","repos_url":"https://api.github.com/users/AndreyRa/repos","events_url":"https://api.github.com/users/AndreyRa/events{/privacy}","received_events_url":"https://api.github.com/users/AndreyRa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-19T14:45:51Z","updated_at":"2015-12-29T13:18:23Z","closed_at":null,"body":"I'm trying to INSERT json-encoded array in the TEXT field with ez_sql_mysql wrapper. I'm using escape() function for every string variable before it passes to the query. My string contains Unicode characters, so my array encoded like this: [\"<foo>\",\"'bar'\",\"\\\"baz\\\"\",\"&blong&\",\"\\u00e9\"].\r\n\r\nNow I found that all my slashes is missing.\r\n\r\nI have searched through the code and found root cause of problems: wrong call of stripslahes() function at 177 line of the ez_sql_mysql.php:\r\nreturn mysql_real_escape_string(stripslahes($str));\r\n\r\nI have deleted stripslashes() call and now all works fine!"},"comment":{"url":"https://api.github.com/repos/ezSQL/ezSQL/issues/comments/167786640","html_url":"https://github.com/ezSQL/ezSQL/issues/85#issuecomment-167786640","issue_url":"https://api.github.com/repos/ezSQL/ezSQL/issues/85","id":167786640,"user":{"login":"bdewater","id":496367,"avatar_url":"https://avatars.githubusercontent.com/u/496367?v=3","gravatar_id":"","url":"https://api.github.com/users/bdewater","html_url":"https://github.com/bdewater","followers_url":"https://api.github.com/users/bdewater/followers","following_url":"https://api.github.com/users/bdewater/following{/other_user}","gists_url":"https://api.github.com/users/bdewater/gists{/gist_id}","starred_url":"https://api.github.com/users/bdewater/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdewater/subscriptions","organizations_url":"https://api.github.com/users/bdewater/orgs","repos_url":"https://api.github.com/users/bdewater/repos","events_url":"https://api.github.com/users/bdewater/events{/privacy}","received_events_url":"https://api.github.com/users/bdewater/received_events","type":"User","site_admin":false},"created_at":"2015-12-29T13:18:23Z","updated_at":"2015-12-29T13:18:23Z","body":"As far as I can tell, the comment on [line 176 in ez_sql_mysqli.php](https://github.com/ezSQL/ezSQL/blob/d608f4c25f1c42b96de2b25cac983e6af8913b1e/mysqli/ez_sql_mysqli.php#L176) (and in other similar files) is incorrect because it always calls stripslashes, without checking if `magic_quotes_gpc` is enabled or not. In my case this corrupted image files I needed to store in a MySQL longblob column on a PHP 5.3 environment with magic quotes off. According to http://php.net/manual/en/security.magicquotes.php it has been removed as off PHP5.4, so this bug will cause more trouble in the future as installations are upgraded.\r\n\r\nAfaik something like the code below (adapted from [this example](http://php.net/manual/en/function.get-magic-quotes-gpc.php) from the PHP manual) should replace line 188 in order to have it function like the comment describes:\r\n```php\r\nif ( get_magic_quotes_gpc() ) {\r\n  $str = stripslashes($str);\r\n}\r\n\r\nreturn $this->dbh->escape_string($str);\r\n```"}}