htmlspecialchars converts apostrophes to %27 and backslashes to %5C, so the `stripslashes` in `stripslashes(htmlspecialchars($_POST['db_password']))` is actually a no-op.

To convert this back to the original string, we therefore only need to do a urldecode(). To write this into config.inc.php as PHP code we add addslashes(). `addslashes(urldecode($db_pwd))` is therefore correct. magic_quotes_gpc is not relevant to this section of code because of how db_password is encoded in the first place (through htmlspecialchars).