Check the manual; magic_quotes, mysql_escape_string and mysql_real_escape_string have already been deprecated/removed.

I'm aware of that thanks, as noted in the last line:

Efforts are being made to clean it up, but for a language to ever end up in a place with that sort of library functions is a pretty big red flag.

"for a language to ever end up in a place with that sort of library functions is a pretty big red flag."

At the time it was reasonable .. but PHP evolved and learned lessons, it didn't just stop there as you seem to be saying.

mysql_escape_string [1] mysql_real_escape_string [2]

Why is exposing a C library's functions and their names PHP's fault?

[1] http://dev.mysql.com/doc/refman/5.5/en/mysql-escape-string.h... [2] http://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-str...

Because php ends up combining the API consistency of C with the syntactic elegance of visual basic. I say this as someone who programs php professionally, the fact that they still haven't provided a complete set of OO api's very much speaks against the language stewards. PHP could have a sane subset, like javascript, but because there are gaps in the API (like the string and array API's, which are horrible) you can't get a sane subset without adding some extra API wrappers of your own.

And that's why it's impossible to build frameworkless PHP code that is elegant, something that even the designed-in-10-days javascript lets you do.

Still, i like php for its getting things done mentality. What it lacks in elegance it makes up for in productivity.