|
|
|
|
Bookmark this on Delicious
Share on Facebook
 Slashdot It!
Digg Disabling Magic QuotesThe magic_quotes_gpc directive may only be disabled at the system level, and not at runtime. In otherwords, use of ini_set() is not an option. Example 10.1. Disabling magic quotes server side
An example that sets the value of these directives to
; Magic quotes
If access to the server configuration is unavailable, use of
php_flag magic_quotes_gpc OffIn the interest of writing portable code (code that works in any environment), like if setting at the server level is not possible, here's an example to disable magic_quotes_gpc at runtime. This method is inefficient so it's preferred to instead set the appropriate directives elsewhere. Example 10.2. Disabling magic quotes at runtime<?phpCode Examples / Notes » security.magicquotes.disablingdedlfix
The function stripslashes_deep() ignores slashes in the keys For example a query string like this: ?foo'bar=baz'bal Output of var_dump($_GET) is: array(1) { ["foo\'bar"]=> string(8) "baz\'bal" } after stripslashes_deep(): array(1) { ["foo\'bar"]=> string(7) "baz'bal" } If you want the keys to be stripslashed too, you have to unset() the addslahed key and to add a stripslashed version. But keep in mind that this will change the order of the array. rdk
The function parse_str() (http://us3.php.net/manual/en/function.parse-str.php) is also affected by magic_quotes_gpc, so if that function is called anywhere, stripslashes_deep won't be sufficient by itself.
17-dec-2006 08:20
PHP's magic quotes function has the strange behavior of not adding slashes to top level keys in GPC key/value pairs but adding the slashes in deeper level keys. To demonstrate, a URI of: example.php?a'b[c'd]=e'f produces: array("a'b" => array("c\'d" => "e\'f")) The current example for removing magic quotes does not do anything to keys, so after running stripslashes_deep, you would end up with: array("a'b" => array("c\'d" => "e'f")) Which, needless to say, is wrong. As if you had magic quotes off, it would have been: array("a'b" => array("c'd" => "e'f")) I have written a snippet of code compatible with PHP 4.0.0 and above that handles this correctly: if (get_magic_quotes_gpc()) { function undoMagicQuotes($array, $topLevel=true) { $newArray = array(); foreach($array as $key => $value) { if (!$topLevel) { $key = stripslashes($key); } if (is_array($value)) { $newArray[$key] = undoMagicQuotes($value, false); } else { $newArray[$key] = stripslashes($value); } } return $newArray; } $_GET = undoMagicQuotes($_GET); $_POST = undoMagicQuotes($_POST); $_COOKIE = undoMagicQuotes($_COOKIE); $_REQUEST = undoMagicQuotes($_REQUEST); } sunrunner20
If php_flag magic_quotes_gpc off does not work Use php_value magic_quotes_gpc off insteadin your .htaccess file |
