Re: magic_quotes on the environment?

Rasmus Lerdorf wrote:

I'm not convinced that escaping environment data is the correct thing to do in the first place, and I would like to change php to not escape env vars if magic_quotes_gpc is on. Any opinions on this?

This changed somewhere along the line then. Originally magic quotes only touched GPC data. I never noticed it also did it to the environment and I'd consider that to be a bug. -Rasmus

Hmm, actually, *any* variable passed through php_register_variable() will get escaped if magic_quotes_gpc is on, irregardless of what array it is getting registered into, so this effects _ENV, _SERVER and _FILES in addition to _GET,_POST and _COOKIE. I also don't know if any other stuff happens to use php_register_variable that may not want escaping. Shane