magic_quotes_gpc() on or off?

Path	csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!feeder.news-service.com!feeder.news-service.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	Simon <bad@example.com>
Newsgroups	comp.lang.php
Subject	magic_quotes_gpc() on or off?
Date	Wed, 11 May 2011 09:28:03 +0200
Lines	63
Message-ID	<92us45F6n8U1@mid.individual.net> (permalink)
Mime-Version	1.0
Content-Type	text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	individual.net s2efXsRdT6xtISSnA28OIQZjmvBMR4WkZczKWLNItd+ZMF2N8q
Cancel-Lock	sha1:H/ZdJqAe79jc5Rsbguz4n0t2q/Y=
User-Agent	Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Thunderbird/3.1.10
Xref	x330-a1.tempe.blueboxinc.net comp.lang.php:1502

Show key headers only | View raw

Hi,

On my dev machine(s) I have:
magic_quotes_gpc = Off and magic_quotes_runtime = Off

as far as I understand this is the 'preferred' settings when it comes to 
magic quotes.

On the live machine I see that the values are:

magic_quotes_gpc = On and magic_quotes_runtime = Off

I think this is a throw back of upgrading from 4.x to 5.x many moons 
ago, (the value should not be set as per 
http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-gpc).

But as a point of interest, this causes a problem when I try to save 
data in the database.
According to http://php.net/manual/en/function.mysql-real-escape-string.php

"If magic_quotes_gpc is enabled, first apply stripslashes() to the data. 
Using this function on data which has already been escaped will escape 
the data twice."

so if I have:

////////////////////////////////////////////////////////////////////////////

// get a proper MySQL connection for mysql_real_escape_string() to work.
...
//
//
$data = 'H\hi';	// a random string that I want to save 'as is' in the 
db. Note the 'escaped' character.

//
// now try and save it to the db
//
// Stripslashes if need be
if (get_magic_quotes_gpc())
{
   $data = stripslashes($data);
}

// escape
$data = mysql_real_escape_string($data);

echo $data;
////////////////////////////////////////////////////////////////////////////

You will see that the data has become 'Hhi', the '\' has been stripped, 
and the data is no longer saved as expected.

If I turn magic_quotes_gpc=off this is a moot point.
But I was wondering how you could get it to work with magic_quotes_gpc=On

Any suggestions? comments?

Thanks

Simon

Back to comp.lang.php | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 09:28 +0200
  Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-11 06:38 -0400
    Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 13:49 +0200
      Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-11 11:29 -0400
        Re: magic_quotes_gpc() on or off? Michael Fesser <netizen@gmx.de> - 2011-05-13 21:25 +0200
          Re: magic_quotes_gpc() on or off? Jerry Stuckle <jstucklex@attglobal.net> - 2011-05-13 18:44 -0400
  Re: magic_quotes_gpc() on or off? "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2011-05-11 12:45 +0200
    Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 13:53 +0200
      Re: magic_quotes_gpc() on or off? "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2011-05-11 16:13 +0200
        Re: magic_quotes_gpc() on or off? Simon <bad@example.com> - 2011-05-11 16:15 +0200

csiph-web