note 61188 added to security.magicquotes
| From: | jfrim at idirect dot com | Date: | Fri, 27 Jan 2006 18:31:42 +0000 |
| Subject: | note 61188 added to security.magicquotes | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-102573@lists.php.net to get a copy of this message | ||
Unfortunately magic_quotes_gpc can not be changed at run-time, but here's a code block which
will effectively get rid of it when executed. Use this for PHP scripts which must be portable or
run on servers where magic_quotes_gpc could be configured either way.
Note that the PHP help is a little misleading... Magic_quotes_gpc affects more than just the Get,
Post, and Cookie data!
<?php
//Prevent Magic Quotes from affecting scripts, regardless of server settings
//Make sure when reading file data,
//PHP doesn't "magically" mangle backslashes!
set_magic_quotes_runtime(FALSE);
if (get_magic_quotes_gpc()) {
/*
All these global variables are slash-encoded by default,
because magic_quotes_gpc is set by default!
(And magic_quotes_gpc affects more than just $_GET, $_POST, and $_COOKIE)
*/
$_SERVER = stripslashes_array($_SERVER);
$_GET = stripslashes_array($_GET);
$_POST = stripslashes_array($_POST);
$_COOKIE = stripslashes_array($_COOKIE);
$_FILES = stripslashes_array($_FILES);
$_ENV = stripslashes_array($_ENV);
$_REQUEST = stripslashes_array($_REQUEST);
$HTTP_SERVER_VARS = stripslashes_array($HTTP_SERVER_VARS);
$HTTP_GET_VARS = stripslashes_array($HTTP_GET_VARS);
$HTTP_POST_VARS = stripslashes_array($HTTP_POST_VARS);
$HTTP_COOKIE_VARS = stripslashes_array($HTTP_COOKIE_VARS);
$HTTP_POST_FILES = stripslashes_array($HTTP_POST_FILES);
$HTTP_ENV_VARS = stripslashes_array($HTTP_ENV_VARS);
if (isset($_SESSION)) { #These are unconfirmed (?)
$_SESSION = stripslashes_array($_SESSION, '');
$HTTP_SESSION_VARS = stripslashes_array($HTTP_SESSION_VARS, '');
}
/*
The $GLOBALS array is also slash-encoded, but when all the above are
changed, $GLOBALS is updated to reflect those changes. (Therefore
$GLOBALS should never be modified directly). $GLOBALS also contains
infinite recursion, so it's dangerous...
*/
}
function stripslashes_array($data) {
if (is_array($data)){
foreach ($data as $key => $value){
$data[$key] = stripslashes_array($value);
}
return $data;
}else{
return stripslashes($data);
}
}
?>
----
Server IP: 66.207.199.35
Probable Submitter: 67.43.136.4
----
Manual Page -- http://www.php.net/manual/en/security.magicquotes.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+61188
Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=added+to+the+manual
Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=bad+code
Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=spam
Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=useless
Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=non-english
Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes&reason=already+in+docs
Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+61188&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+61188&report=yes
Search -- http://master.php.net/manage/user-notes.php