note 93277 added to function.get-magic-quotes-gpc

The goal is to leave the input untouched in PHP 5.2.8. Let's have this sample text given in $_POST['example']: a backslash ( \ ), a single-quote ( ' ), a double-quote ( " ) and a null character ( \0 ) Let's have two simple scripts: Script A: <?php echo $_POST['example']; ?> Script B: <?php echo stripslashes($_POST['example']); ?> Let's have four different configurations and corresponding output: Case #1: * magic_quotes_gpc = Off * magic_quotes_sybase = Off A: a backslash ( \ ), a single-quote ( ' ), a double-quote ( " ) and a null character ( \0 ) B: a backslash ( ), a single-quote ( ' ), a double-quote ( " ) and a null character ( � ) Case #2 * magic_quotes_gpc = On * magic_quotes_sybase = Off A: a backslash ( \\ ), a single-quote ( \' ), a double-quote ( \" ) and a null character ( \\0 ) B: a backslash ( \ ), a single-quote ( ' ), a double-quote ( " ) and a null character ( \0 ) Case #3 * magic_quotes_gpc = On * magic_quotes_sybase = On A: a backslash ( \ ), a single-quote ( '' ), a double-quote ( " ) and a null character ( \0 ) B: a backslash ( \ ), a single-quote ( ' ), a double-quote ( " ) and a null character ( � ) Case #4 * magic_quotes_gpc = Off * magic_quotes_sybase = On A: a backslash ( \ ), a single-quote ( ' ), a double-quote ( " ) and a null character ( \0 ) B: a backslash ( ), a single-quote ( ' ), a double-quote ( " ) and a null character ( � ) Conclusions: 1) we do not need to do anything, if the magic_quotes_gpc is disabled (cases 1 and 4); 2) stripslashes($_POST['example']) only works, if the magic_quotes_gpc is enabled, but the magic_quotes_sybase is disabled (case 2); 3) str_replace("''", "'", $_POST['example']) will do the trick if both the magic_quotes_gpc and the magic_quotes_sybase are enabled (case 3); <?php function disable_magic_quotes_gpc() { if (TRUE == function_exists('get_magic_quotes_gpc') && 1 == get_magic_quotes_gpc()) { $mqs = strtolower(ini_get('magic_quotes_sybase')); if (TRUE == empty($mqs) || 'off' == $mqs) { // we need to do stripslashes on $_GET, $_POST and $_COOKIE } else { // we need to do str_replace("''", "'", ...) on $_GET, $_POST, $_COOKIE } } // otherwise we do not need to do anything } ?> Important notes: 1) arrays need to be processed recursively; 2) both stripslashes and str_replace functions always return strings, so: * TRUE will become a string "1", * FALSE will become an empty string, * integers and floats will become strings, * NULL will become an empty string. On the other hand you only need to process strings, so use the is_string function to check; 3) when dealing with other (than GPC) data sources, such as databases or text files, remember to play with the magic_quotes_runtime setting as well, see, what happens and write a corresponding function, i.e. disable_magic_quotes_runtime() or something. 4) VERY IMPORTANT: when testing, remember the null character. Otherwise your tests will be inconclusive and you may end up with... well, serious bugs :) ---- Server IP: 69.147.83.197 Probable Submitter: 77.65.92.156 ---- Manual Page -- http://www.php.net/manual/en/function.get-magic-quotes-gpc.php Edit -- https://master.php.net/note/edit/93277 Del: integrated -- https://master.php.net/note/delete/93277/integrated Del: useless -- https://master.php.net/note/delete/93277/useless Del: bad code -- https://master.php.net/note/delete/93277/bad+code Del: spam -- https://master.php.net/note/delete/93277/spam Del: non-english -- https://master.php.net/note/delete/93277/non-english Del: in docs -- https://master.php.net/note/delete/93277/in+docs Del: other reasons-- https://master.php.net/note/delete/93277 Reject -- https://master.php.net/note/reject/93277 Search -- https://master.php.net/manage/user-notes.php