tibberous Posted February 15, 2008 Share Posted February 15, 2008 http://us.php.net/magic_quotes Magic quotes are gone in version 6. That means that SQL injections are back, and PHP 6 is going to be as hard to switch to as version 4 was with the register_globals switch, only far worse because magic quotes can't be turned on, and because hackers are going to have free rein over most the worlds PHP 6 sites. I'm guessing this is to get rid of amateurs and mean more work for us PHP guys - just now I'm gonna have to hear about it from my jsp-loving friend =/ Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/ Share on other sites More sharing options...
TheFilmGod Posted February 15, 2008 Share Posted February 15, 2008 http://us.php.net/magic_quotes Magic quotes are gone in version 6. That means that SQL injections are back, and PHP 6 is going to be as hard to switch to as version 4 was with the register_globals switch, only far worse because magic quotes can't be turned on, and because hackers are going to have free rein over most the worlds PHP 6 sites. I'm guessing this is to get rid of amateurs and mean more work for us PHP guys - just now I'm gonna have to hear about it from my jsp-loving friend =/ This is a good thing. I'm tired of people trying to code secure things like passwords/usernames and not know how to use pattern checking and use validation properly. Magic quotes was just "the easy way out." Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467357 Share on other sites More sharing options...
PFMaBiSmAd Posted February 15, 2008 Share Posted February 15, 2008 If you were relying on magic quotes being on to escape data, that was just being lazy (expecting the programming language to do something for you that you should have been writing code to do.) See these proper ways of escaping data that will always work, irregardless of php version or php configuration - http://php.net/mysql_real_escape_string and http://www.php.net/manual/en/function.addslashes.php Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467358 Share on other sites More sharing options...
neylitalo Posted February 15, 2008 Share Posted February 15, 2008 I'm guessing this is to get rid of amateurs and mean more work for us PHP guys No, it's because there was an overwhelming negative response to magic_quotes_gpc. Magic quotes were, as has been said before, the lazy way out, and more often than not, were responsible for breaking more stuff than they fixed. Anything that eliminates poor practices is a good thing, in this man's opinion. irregardless No such word. Regardless is what you're looking for. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467368 Share on other sites More sharing options...
Daniel0 Posted February 15, 2008 Share Posted February 15, 2008 Magic quotes are gone in version 6. That means that SQL injections are back Only if you're a crap programmer (hope I didn't offend anyone). Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467551 Share on other sites More sharing options...
Liquid Fire Posted February 15, 2008 Share Posted February 15, 2008 That means that SQL injections are back, and PHP 6 is going to be as hard to switch This is only true is you still rely on them. No offense but only noobish programmers still think magic quotes are a good idea. It would not be bad if this move gets rid of some crappy programmers(which IMO has been a problem for good PHP programmers) Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467573 Share on other sites More sharing options...
testtesttesttest Posted February 15, 2008 Share Posted February 15, 2008 We'll, yes, you can write scripts without it, and yes, it will work fine if your good. Though by the same logic we could all write websites in C that bound to the correct socket and handled the GET and POST requests - would want to take the easy way out and use a crutch like apache, 'good' programmers could still do it. I'm just saying that what makes languages good or bad are their features - the 'proper' way is the easy way, unless their is a strong reason why the easy way is bad. Yes - magic quotes isn't needed, and putting addslashes before every $_POST will make up for not having it - still annoying... Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467814 Share on other sites More sharing options...
Daniel0 Posted February 15, 2008 Share Posted February 15, 2008 Yes - magic quotes isn't needed, and putting addslashes before every $_POST will make up for not having it - still annoying... That depends on the programmer. <?php class Database_MySQL extends Database { // ... public function insert($table, array $data = array()) { $columns = $values = array(); foreach($data as $key => $value) { $columns[] = "`{$key}`"; $values[] = '?'; } $query = "INSERT INTO `{$table}` (" . join(', ', $columns) . ') VALUES (' . join(', ', $values) . ')'; $statement = $this->db->prepare($query); return $statement->execute(array_values($data)); } // ... } ?> Code uses PDO. I know some people do this: <?php $username = mysql_real_escape_string($_POST['username']); $password = mysql_real_escape_string($_POST['password']); $email = mysql_real_escape_string($_POST['email']); // etc... but that's their choice. Also, you might not always need the data with slashes so it makes more sense to add it when needed instead of removing them when it's not. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-467869 Share on other sites More sharing options...
ardyandkari Posted February 15, 2008 Share Posted February 15, 2008 Magic quotes are gone in version 6. That means that SQL injections are back Only if you're a crap programmer (hope I didn't offend anyone). :'( I'm a crap programmer you TURD!!! :'( Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-468042 Share on other sites More sharing options...
448191 Posted February 15, 2008 Share Posted February 15, 2008 Ooo, I'm loving this.. Popcorn anyone? Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-468045 Share on other sites More sharing options...
zachrb Posted February 18, 2008 Share Posted February 18, 2008 lol, I dont know half of what yall are talking about. I am that big of a noob at PHP. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-469591 Share on other sites More sharing options...
juke Posted February 20, 2008 Share Posted February 20, 2008 lol, I dont know half of what yall are talking about. I am that big of a noob at PHP. Check out http://davidwalsh.name/upcoming-php6-additions-changes/ All the new stuff being added and removed in the upcoming version of PHP. :> Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-471993 Share on other sites More sharing options...
acidglitter Posted February 20, 2008 Share Posted February 20, 2008 quotes always confused me when i switched servers. i think this will make everything a lot more simple Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-472223 Share on other sites More sharing options...
atholon Posted February 21, 2008 Share Posted February 21, 2008 When is the ETA of PHP 6? Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-472901 Share on other sites More sharing options...
tibberous Posted February 22, 2008 Author Share Posted February 22, 2008 Wow... I didn't even know about the other stupid changes =/ Thankfully I just bought a dedicated and can keep PHP5 - since at the rate there going PHP7 is going to be JSP with dollar signs... then in PHP8 they can deprecate $'s, since you really should give variables strict types... Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-473547 Share on other sites More sharing options...
Liquid Fire Posted February 22, 2008 Share Posted February 22, 2008 Wow... I didn't even know about the other stupid changes =/ Thankfully I just bought a dedicated and can keep PHP5 - since at the rate there going PHP7 is going to be JSP with dollar signs... then in PHP8 they can deprecate $'s, since you really should give variables strict types... I don't know to much about Java but PHP is not that like java, First of all, Java is fully OOP and i don't think PHP is going to go that way(however they should still fully support Objects, I wish they they would support multiple inheritance). Also strict typing is not a bad thing but that is also something else i doubt they would get rid of. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-473550 Share on other sites More sharing options...
Daniel0 Posted February 22, 2008 Share Posted February 22, 2008 OOP is not just "using objects"... Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-473558 Share on other sites More sharing options...
Stooney Posted February 22, 2008 Share Posted February 22, 2008 Also, safe mode is removed in php6. Thought I'd add that. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-473713 Share on other sites More sharing options...
tomfmason Posted February 23, 2008 Share Posted February 23, 2008 and putting addslashes before every $_POST will make up for not having it - still annoying... yeah, addslashes will make up for the lack of magic quotes but it is not enough to stop all types of sql injections. If you think addslashes or magic quotes are enough, you may want to consider reading some of the comments in the manual http://php.net/addslashes . IMHO, that is the reason that magic quotes are being phased out. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-474812 Share on other sites More sharing options...
Liquid Fire Posted February 24, 2008 Share Posted February 24, 2008 I think most of the changes are going to make PHP more secure because people are not going to have to make sure themself that things are programmed right instead of thinking things like magic quotes will save them. The only things that makes no sense at all is the no more {} inside double quotes string which will be replaced with [](I think to no the reason behind this because i have a big feeling this will break A LOT of existing php 5 code if people try to upgrade to PHP 6. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-474842 Share on other sites More sharing options...
Daniel0 Posted February 24, 2008 Share Posted February 24, 2008 The only things that makes no sense at all is the no more {} inside double quotes string which will be replaced with [](I think to no the reason behind this because i have a big feeling this will break A LOT of existing php 5 code if people try to upgrade to PHP 6. You misinterpreted that. This is the change: <?php $string = 'hello'; echo $string[0]; // correct in PHP6 echo $string{0}; // wrong in PHP6 ?> Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-474969 Share on other sites More sharing options...
Liquid Fire Posted February 24, 2008 Share Posted February 24, 2008 oh so "the variable value is {$value}" will still be value in PHP6? I did not even know you could access array indexes with {}. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-475063 Share on other sites More sharing options...
Daniel0 Posted February 24, 2008 Share Posted February 24, 2008 Sure it will. It would break far to many scripts if they removed that. Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-475067 Share on other sites More sharing options...
redarrow Posted February 24, 2008 Share Posted February 24, 2008 this is old {} from php6 your need to set it as on from php6 oh so "the variable value is {$value}" will still be value in PHP6? I did not even know you could access array indexes with {}. default will be the [] ok. ps. your title php5 in 8 years, might i guess be php 9 i think, good luck.....((even echo might be gone then lol)) Quote Link to comment https://forums.phpfreaks.com/topic/91190-plan-on-using-php-5-for-the-next-8-years/#findComment-475339 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.