What are `magic quotes` in PHP?

Magic quotes refer to a deprecated feature in PHP that was designed to automatically escape incoming data, primarily for reasons related to security. When this feature was enabled, it would prepend a backslash to certain characters in user input, such as single quotes, double quotes, backslashes, and NULL characters. This was meant to prevent issues such as SQL injection by ensuring that these characters were handled safely when included in SQL queries.

However, this feature has been criticized for several reasons, including inconsistency in behavior across platforms and its tendency to create confusion. The automatic escaping could lead to problems in cases where data was expected to be unescaped, and further handling of this data could require additional programming effort to remove the extraneous backslashes.

Because of these problems, magic quotes were removed entirely from PHP as of version 5.4. Users are now encouraged to handle escaping manually using functions like mysqli_real_escape_string() or prepared statements to ensure more reliable and secure database interactions.