note 72402 modified in security.magicquotes by joey

I think most of the people posting below are a little confused about how this works... To the person who said use addslashes rather than stripslashes... Well, the prefered use of MAGIC_QUOTES_GPC is off, so if you are designing code in such a manner well, using addlashes is of course going to do the same thing as having it turned on. DUH! Next on the agenda, is the guy who posted the code which the above anonymous person(s) made a comment about. Good, except design your code to not use the HTTP_GET_VARS etc at all, PHP3 is completely outdated... Turn off these options in your .INI/.htaccess/registry files (etc) as well! Additionally, I do not believe that MAGIC_QUOTES affects $_SERVER or $_ENV. I also don't think it affects $_FILES however these values ARE submitted from the user therefor may get escaped. Heres some code directly from a CMS I'm working on. # strips slashes to a multi dimensional array, by reference function stripslashes_arrays(&$array) { if ( is_array($array) ) { $keys = array_keys($array); foreach ( $keys as $key ) { if ( is_array($array[$key]) ) { stripslashes_arrays($array[$key]); } else { $array[$key] = stripslashes($array[$key]); } } } } # --- Handle input var escapes # magic_quotes_runtime could corrupt data, # so make sure it's turned off... set_magic_quotes_runtime(0); # All escapes are handled from code... # So rather, strip slashes if magic quotes is enabled if( get_magic_quotes_gpc() ) { stripslashes_arrays($_GET); stripslashes_arrays($_POST); stripslashes_arrays($_COOKIE); # stripslashes_arrays($_FILES); # verify $_FILES gets escapes by MAGIC_QUOTES first } --was-- I think most of the people posting below are a little confused about how this works... To the person who said use addslashes rather than stripslashes... Well, the prefered use of MAGIC_QUOTES_GPC is off, so if you are designing code in such a manner well, using addlashes is of course going to do the same thing as having it turned on. DUH! Next on the agenda, is the guy who posted the code which the above anonymous person(s) made a comment about. Good, except design your code to not use the HTTP_GET_VARS etc at all, PHP3 is completely outdated... Turn off these options in your .INI/.htaccess/registry files (etc) as well! Additionally, I do not believe that MAGIC_QUOTES affects $_SERVER or $_ENV. I also don't think it affects $_FILES however these values ARE submitted from the user therefor may get escaped. Heres some code directly from a CMS I'm working on. # strips slashes to a multi dimensional array, by reference function stripslashes_arrays(&$array) { if ( is_array($array) ) { $keys = array_keys($array); foreach ( $keys as $key ) { if ( is_array($array[$key]) ) { stripslashes_arrays($array[$key]); } else { $array[$key] = stripslashes($array[$key]); } } } } # --- Handle input var escapes # magic_quotes_runtime is some retarded shit and could corrupt data, # so make sure it's turned off... set_magic_quotes_runtime(0); # All escapes are handled from code... # So rather, strip slashes if magic quotes is enabled if( get_magic_quotes_gpc() ) { stripslashes_arrays($_GET); stripslashes_arrays($_POST); stripslashes_arrays($_COOKIE); # stripslashes_arrays($_FILES); # verify $_FILES gets escapes by MAGIC_QUOTES first } http://php.net/manual/en/security.magicquotes.php