Re: Proposal - magic quotes

> >>>>I think we need to create a section in the manual, similar to > > > > "References > > > >>>>Explained" with all the information about magic quotes. > >>>> > >>>>What do you think? > >>> > >>>Would be nice. Three of the cornerstones are: register_globals, > >>>references and magic_quotes :) > >> > >>As long as you put a big blinking text "DO NOT USE THIS MISFEATURE" > >>that's fine ;-) > > > > Hehe :) > > > > Where should we create this section, Gabor? > > References is in "Language Reference", I'm not sure Magic Quotes would fall > > under this. > > I thought about features or security, and the others provided quite > decent reasons to put it into security. It's importance will even be > elavated this way. > > > I think we can probably get away with ignoring register_globals, as it is > > off by default now. > > There are a lot of questions still about nonexistant variables. This > needs to stay in the manual (and is already documented under the > security section). A few topics for this section: * Differences and examples of_gpc, _runtime, and _sybase. * Examples of SQL injection with and without magical quotes, and how to prevent each. * Discuss '' vs \' and which databases work with only the first...so basically not only discuss MySQL. * Dealing with numeric (int) values in SQL. * Why validating data is so important. * Why not to have magical quotes on AND do addslashes() so essentially addslashes(addslashes($data)). We should never have \' IN the database. In otherwords, explain why/what we're escaping here. * Mention alternatives and why they differ (like mysql_escape...) This brings us to the topic of data validation. The section titled "security.variables" could use improvement and additional examples on HOW to validate data, not just that it's good to do. Regarding register_globals, although it's way to late for this we need an "officially preferred" way to mimick the (un)setting of register_globals at runtime. Too many user notes mention this as apparently the entire world does not have access to the PHP_INI_PERDIR level yet are paranoid enough to deal with this. If not show ways mimick this, at least discuss the issue. If I see one more user comment on this I may explode. Regards, Philip