#46313 [Opn->Csd]: Magic quotes broke $_FILES

ID: 46313 Updated by: lbarnaud@php.net Reported By: david at grudl dot com -Status: Open +Status: Closed Bug Type: HTTP related Operating System: windows xp PHP Version: 5.3.0alpha2 New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Fixed for slashes vs non-slashed keys in $_FILES. For truncated filenames, it seems to be wanted on Windows, as \ is a path separator. Previous Comments: ------------------------------------------------------------------------ [2008-10-16 11:36:40] david at grudl dot com Description: ------------ When magic_quotes_gpc are enabled, array $_FILES in weird. 1) truncated file name (see "closed" bug #29369) 2) slashes and non-slashed keys Reproduce code: --------------- <form action="" method="post" enctype="multipart/form-data"> <input type="file" name="o'file"> </form> Lets upload file named o'brazek.png (there are quotes in element name and in file name to demonstrate both errors) Expected result: ---------------- array(2) { "o\'file" => array(4) { "name" => string(11) "o'brazek.png" // or o\'brazek.png ? "type" => string(11) "image/x-png" "error" => int(0) "size" => int(20624) "tmp_name" => string(23) "C:\PHP\temp\php3ED8.tmp" } } Actual result: -------------- array(2) { "o\'file" => array(4) { "name" => string(11) "o" // name is truncated after quote "type" => string(11) "image/x-png" "error" => int(0) "size" => int(20624) } "o'file" => array(1) { // tmp_name is stored in different key "tmp_name" => string(23) "C:\PHP\temp\php3ED8.tmp" } } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=46313&edit=1