title: PHP 5.3 automatically escapes $_GET/$_POST from form strings?
body: <p>My server admin recently upgraded to PHP 5.3 and I'm getting a weird "bug" (or <a href="https://bugs.php.net/bug.php?id=48669" rel="nofollow">feature</a>, as the PHP folks have it). I had <code>mysql_real_escape_string</code> around most of my string form data for obvious safety reasons, but now it seems this escaping is already done by PHP.</p>
  
  <pre><code>&lt;?php
  
  echo $_GET["escaped"];
  
  ?&gt;
  
  &lt;form method="get"&gt;
      &lt;input type="text" name="escaped" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>This outputs, if I enter for instance <code>escape 'this test'</code>, <code>escape \'this test\'</code>. Same goes if I use <code>POST</code> instead of <code>GET</code>.</p>
  
  <p>Is it directly tied to the 5.3 upgrade or could my admin have triggered some automatic switch in the php.ini file?</p>
  
  <p>Also, should I just leave it as is (in the event that it is indeed a good fail proof mechanism that correctly catches all get and post variables), or should I disable it (if that's even possible!) and go back to <code>mysql_real_escape_string</code>? My guts tell me approach 2 would be best, but approach 1 would be somewhat automagical. :)</p>
  
  <p>EDIT: Actually, I need to disable it. Sometimes I gather the form data and resend it to the client form in case something was wrong (i.e. missing field), so I don't want him/her to have slashes appearing out of nowhere. </p>