Magic Quotes Question

[graham23s]

Hi Guys,

 

By default magic quotes is turned off on my server, but i have given a few copies of scripts out and the guys are saying that on insertion the script is adding slashes so i assume that magic quaotes is on on their servers, my question is what would be the best thing for me to do to make it work on both types of servers?

 

thanks for any info guys

 

Graham

[otuatail]

you can test to see if magic quotes are enabled and take action depending on the result.

 

if(get_magic_quotes_gpc())

echo "Magic quotes are enabled";

else

echo "Magic quotes are disabled";

 

[Psycho]

See Example #2 in the manual to remove slashes if magic quotes is on at runtime: http://php.net/manual/en/security.magicquotes.disabling.php

[The Little Guy]

Like so:

<?php
if (!get_magic_quotes_gpc()) {
    $lastname = mysql_real_escape_string($_POST['lastname']);
} else {
    $lastname = $_POST['lastname'];
}

$sql = mysql_query("INSERT INTO lastnames (lastname) VALUES ('$lastname')");
?>

[graham23s]

Sorry for the late reply guys thanks a lot it put me in the right direction

 

cheers

 

Graham

[salathe]

Like so:

<?php
if (!get_magic_quotes_gpc()) {
    $lastname = mysql_real_escape_string($_POST['lastname']);
} else {
    $lastname = $_POST['lastname'];
}

$sql = mysql_query("INSERT INTO lastnames (lastname) VALUES ('$lastname')");
?>

 

Absolutely do not do this. If magic quotes are enabled, you will be feeding unsanitized (except for the magic quotes escaping) user input into your query! As in the example link provided by mjdamato, check if magic quotes is enabled and undo what it has done then regardless of the magic quote setting, escape the input when adding it into the queries.

[The Little Guy]

Like so:

<?php
if (!get_magic_quotes_gpc()) {
    $lastname = mysql_real_escape_string($_POST['lastname']);
} else {
    $lastname = $_POST['lastname'];
}

$sql = mysql_query("INSERT INTO lastnames (lastname) VALUES ('$lastname')");
?>

 

Absolutely do not do this. If magic quotes are enabled, you will be feeding unsanitized (except for the magic quotes escaping) user input into your query! As in the example link provided by mjdamato, check if magic quotes is enabled and undo what it has done then regardless of the magic quote setting, escape the input when adding it into the queries.

 

That was right from php.net

[PFMaBiSmAd]

That was right from php.net

 

You mean from the same folks that thought that what magic_quotes did was a good idea?

[Psycho]

That was right from php.net

 

Care to provide a link. Here is just one direct quote from php.net regarding magic quotes:

 

Why not to use Magic Quotes

 

Warning

This feature has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.

http://www.php.net/manual/en/security.magicquotes.whynot.php

http://php.net/manual/en/security.magicquotes.disabling.php

[Mchl]

There is an example like this on http://pl.php.net/manual/en/function.get-magic-quotes-gpc.php and there's no mention about magic quotes being depreceted there.

[Psycho]

There is an example like this on http://pl.php.net/manual/en/function.get-magic-quotes-gpc.php and there's no mention about magic quotes being depreceted there.

 

Probably should be, but if you click on any of the three links in the description for that function the first thing you will see is the same messages I posted above.

 

Description

int get_magic_quotes_gpc ( void )

Returns the current configuration setting of magic_quotes_gpc

 

Keep in mind that attempting to set magic_quotes_gpc at runtime will not work.

 

For more information about magic_quotes, see this security section.

[salathe]

That was right from php.net

 

Except you changed from using addslashes to mysql_real_escape_string, thus spoiling the whole purpose of that if/else block. Admittedly, using a SQL query like that was a bad choice and the manual example should be updated to reflect that (along with a big, red don't use magic quotes, they're deprecated warning). Today's practice is to remove the added slashes if magic quotes are enabled and deal with escaping values for SQL queries, or output to the page, as appropriate.

[cs.punk]

<?php
if (get_magic_quotes_gpc()) 
{$_GET = array_map('stripslashes', $_GET);
  $_POST = array_map('stripslashes', $_POST);
  $_COOKIE = array_map('stripslashes', $_COOKIE);
} 
?>

 

Thats what I use =)

 

Oh and after this just run mysqli_real_escape_string on what ever thing you need.

[Psycho]

Thats what I use =)

 

The only problem with that is if one of the array values is itself an array. The first link I provided has an example of how to handle multidimensional arrays.

[oni-kun]

Heh, Maybe there should be a sticky on how to handle slashes from Magic Quotes, They're almost as bad as headers sent errors. A lot of people tend to not understand their modus operati.

[The Little Guy]

Care to provide a link. Here is just one direct quote from php.net regarding magic quotes:

 

http://us3.php.net/get_magic_quotes_gpc

[Psycho]

Care to provide a link. Here is just one direct quote from php.net regarding magic quotes:

 

http://us3.php.net/get_magic_quotes_gpc

I already responded to that page. As stated, every single one of the links in the description show a warning that magic quotes should not be used.

[Daniel0]

Care to provide a link. Here is just one direct quote from php.net regarding magic quotes:

 

http://us3.php.net/get_magic_quotes_gpc

 

I've changed that example now: http://svn.php.net/viewvc?view=revision&revision=298138

 

Similarly, a deprecation note was added yesterday by salathe: http://svn.php.net/viewvc?view=revision&revision=298127

 

People will have to live with the poor example until next Friday when the mirrors sync with the manual.

[Mchl]

I've changed that example now: http://svn.php.net/viewvc?view=revision&revision=298138

 

Similarly, a deprecation note was added yesterday by salathe: http://svn.php.net/viewvc?view=revision&revision=298127

 

People will have to live with the poor example until next Friday when the mirrors sync with the manual.

Freaks to the rescue!