note 22340 modified in configuration by philip

[[[Editors note: magic_quotes_gpc being on does save a lot of support questions. Everyone is free to read the documentation (php.ini and manual) and plan accordingly. In fact, PHP comes with two php.ini files, one is called php.ini-recommended and it has magic_quotes_gpc off. See also: stripslashes(), get_magic_quotes_gpc(), and .htaccess. ]]] Beware, magic_quotes_gpc is evil ! The option may look very tempting at the first glance. However there are some caveats: 1. Most parameters do not go to a database. In a web application most form field are used internally without the need to store them in a database. Magic quotes cause troubles in these cases. Moreover the data passed to the application is not the data entered by the user if it was processed by magic quotes. This is undesireable. 2. Impedes code reuse. If you feed data from either form parameters or internal data sources into the same function then your function must know if the data was processed by magic quotes or not. 3. Bad surprises at deployment time and code portability. If you do not carefully check if this parameter is set on your development and production system you can run into troubles. Especially if you can not change the settings on one system (because the hoster does not let you). 4. Behaviour can not be controlled at script runtime. The ini_set does not help in this case even though the parameter can be modified at runtime the behaviour does not change. Consequently you are bound to the php.ini settings (which may be not under your control). I therefore request that this option be removed from future versions of PHP and the default behaviour should be FALSE. --was-- Beware, magic_quotes_gpc is evil ! The option may look very tempting at the first glance. However there are some caveats: 1. Most parameters do not go to a database. In a web application most form field are used internally without the need to store them in a database. Magic quotes cause troubles in these cases. Moreover the data passed to the application is not the data entered by the user if it was processed by magic quotes. This is undesireable. 2. Impedes code reuse. If you feed data from either form parameters or internal data sources into the same function then your function must know if the data was processed by magic quotes or not. 3. Bad surprises at deployment time and code portability. If you do not carefully check if this parameter is set on your development and production system you can run into troubles. Especially if you can not change the settings on one system (because the hoster does not let you). 4. Behaviour can not be controlled at script runtime. The ini_set does not help in this case even though the parameter can be modified at runtime the behaviour does not change. Consequently you are bound to the php.ini settings (which may be not under your control). I therefore request that this option be removed from future versions of PHP and the default behaviour should be FALSE. http://www.php.net/manual/en/configuration.php