I am not seeing any difference between what I’m seeing when magic_quotes_gpc is on and when it’s off. How exactly is $db_pwd generated? In step2.php we find

`echo stripslashes(htmlspecialchars($_POST['db_password']));`

being shown to the user, so if $db_pwd is `$_POST['step2']['db_password']` (as is the case in step5.php), then the reverse of this would be what I wrote, i.e., `addslashes(urldecode($db_pwd))`. Or am I be missing something?