title: Successful SQL Injection despite PHP Magic Quotes
body: <p>I have always read that Magic Quotes do not stop SQL Injections at all but I am not able to understand why not! As an example, let's say we have the following query:</p>
  
  <pre><code>SELECT * FROM tablename
    WHERE email='$x';
  </code></pre>
  
  <p>Now, if the user input makes <code>$x=' OR 1=1 --</code>, the query would be:</p>
  
  <pre><code>SELECT * FROM tablename
    WHERE email='\' OR 1=1 --';
  </code></pre>
  
  <p>The backslash will be added by Magic Quotes with no damage done whatsoever!</p>
  
  <p>Is there a way that I am not seeing where the user can bypass the Magic Quote insertions here?</p>