Confusion about mysql_real_escape_string and strip_slashes

Question

I have users entering their name, as in: O'riley.

Before I enter this data into the MySQL DB, I run mysql_real_escape_string.

Problem is, when I then select this data for display and use later, it comes out as: O\'riley.

Obviously, this is the intended operation. What I'm wondering is if there's someway to be sure I can store it in the DB (still safely escaping possible malicious code), so that I don't have to use strip_slashes() on the output EVERY time I call the data throughout the entire web app? Or, am I missing something here?

Thanks.

UPDATE Please refer to the comments in Deceze's answer.

Answer 1

No, it's not the intended operation to store the string as "O\'riley"; it should only be escaped in the query, but not stored this way. I'll guess that PHP puts in the backslash through Magic Quotes, and you escape it again to make it stick.

Disable Magic Quotes.

Answer 2

I personally always turn off magic quotes because it is doing something I haven't told it to do. If you dont have the ability to turn it off, consider including this code at the top of all of your pages.

if (get_magic_quotes_gpc()) {
    function strip_array($var) {
        return is_array($var)? array_map("strip_array", $var):stripslashes($var);
    }

    $_POST = strip_array($_POST);
    $_SESSION = strip_array($_SESSION);
    $_GET = strip_array($_GET);
}