How do I enable/disable magic quotes gpc for my PHP scripts

If you are searching for how to turn magic_quotes_gpc on or off, the short answer is that you no longer can. The setting was removed from PHP more than ten years ago, so on any supported PHP version it is simply gone. This guide explains what it did, why the old .htaccess and ini_set() tricks fail, and how to fix an old script that depended on it.

1. What magic_quotes_gpc did

When magic_quotes_gpc was on, PHP automatically added a backslash before every single quote, double quote, backslash and NUL byte in GET, POST and cookie data (the "gpc"). A name like O'Reilly arrived in your script as O\'Reilly.

It was meant to make careless SQL queries safer, but caused more problems than it solved:

• It escaped for one case only (a quoted MySQL string) and was wrong for HTML, email or files, and it did not reliably stop SQL injection.
• Code had to guess whether the setting was on, so scripts filled up with stripslashes() calls, and data often ended up escaped twice, with stray backslashes saved in the database.

2. Which PHP versions still have it

So on every PHP version that still receives security fixes, magic quotes are off and there is nothing to disable. If your old script shows Call to undefined function get_magic_quotes_gpc(), it is running on PHP 8 and needs the small fix in section 4.

3. Why the old instructions no longer work

Older guides, including an earlier version of this article, suggested one of these:

php_flag magic_quotes_gpc off

ini_set('magic_quotes_gpc', '0');

Neither works today:

• php_flag and php_value in .htaccess only work when PHP runs as an Apache module. None of our shared servers run PHP that way, so the line gives a 500 Internal Server Error. If you added it, remove it. See Troubleshooting 500 Internal Server Error.
• ini_set() could not change this setting even in PHP 5, because the request data has already been processed by the time your script runs. On PHP 5.4 and newer the setting does not exist at all.

4. Fixing an old script that relied on magic quotes

Most legacy code contains a pattern like this:

if (get_magic_quotes_gpc()) {
    $name = stripslashes($_POST['name']);
} else {
    $name = $_POST['name'];
}

On modern PHP, replace it with the plain value:

$name = $_POST['name'] ?? '';

5. What to use instead

The modern rule is simple: keep input as it arrives, and escape it at the moment you use it, for the place you use it.

Databases: prepared statements. The value is sent separately from the SQL, so quotes in it cannot change the query:

$pdo = new PDO('mysql:host=localhost;dbname=mydb;charset=utf8mb4', 'dbuser', 'dbpass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

$stmt = $pdo->prepare('INSERT INTO customers (name, email) VALUES (?, ?)');
$stmt->execute([$_POST['name'] ?? '', $_POST['email'] ?? '']);

HTML output: htmlspecialchars(). Escape anything a visitor supplied before you print it:

echo htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Validation. Check that each value is the type and length you expect, for example with filter_var() for email addresses.

For full examples, read Preventing SQL injection in PHP and Node.js and Preventing XSS in PHP and Node.js.

6. Should you run an old PHP version instead?

Our cPanel servers still have legacy PHP 5.x builds installed for compatibility (measured on our servers, 20 September 2026). That does not make them a good home for a live website. Every PHP 5 release has been without security fixes since the end of 2018, current WordPress and most modern applications will not run on them, and a script that needs magic quotes usually has other security problems too.

Treat an old PHP version as a short bridge while you fix the code, never as a permanent setting. Understanding PHP version compatibility explains how to test an upgrade, and How to change your PHP version shows where the setting is in each control panel.

7. Where Domain India fits

Our cPanel and DirectAdmin shared hosting plans let you choose the PHP version for each account, and our shared plans offer jailed SSH on request (off by default; ask support to enable it), with Git available inside it. Note that phpinfo() is disabled on our cPanel servers, so check your PHP version in the control panel instead.

If an old application breaks after a PHP change, open a support ticket with the page address and the exact error message, and our team can help you find the cause.

Ready to move an old script to modern PHP? Compare cPanel hosting, DirectAdmin hosting and Webuzo hosting, read How to change your PHP version, or open a support ticket if a legacy application stops working.