Path: csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!feeder.news-service.com!feeder.news-service.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Simon <bad@example.com>
Newsgroups: comp.lang.php
Subject: magic_quotes_gpc() on or off?
Date: Wed, 11 May 2011 09:28:03 +0200
Lines: 63
Message-ID: <92us45F6n8U1@mid.individual.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net s2efXsRdT6xtISSnA28OIQZjmvBMR4WkZczKWLNItd+ZMF2N8q
Cancel-Lock: sha1:H/ZdJqAe79jc5Rsbguz4n0t2q/Y=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Thunderbird/3.1.10
Xref: x330-a1.tempe.blueboxinc.net comp.lang.php:1502

Hi,

On my dev machine(s) I have:
magic_quotes_gpc = Off and magic_quotes_runtime = Off

as far as I understand this is the 'preferred' settings when it comes to 
magic quotes.

On the live machine I see that the values are:

magic_quotes_gpc = On and magic_quotes_runtime = Off

I think this is a throw back of upgrading from 4.x to 5.x many moons 
ago, (the value should not be set as per 
http://www.php.net/manual/en/info.configuration.php#ini.magic-quotes-gpc).

But as a point of interest, this causes a problem when I try to save 
data in the database.
According to http://php.net/manual/en/function.mysql-real-escape-string.php

"If magic_quotes_gpc is enabled, first apply stripslashes() to the data. 
Using this function on data which has already been escaped will escape 
the data twice."

so if I have:

////////////////////////////////////////////////////////////////////////////

// get a proper MySQL connection for mysql_real_escape_string() to work.
...
//
//
$data = 'H\hi';	// a random string that I want to save 'as is' in the 
db. Note the 'escaped' character.

//
// now try and save it to the db
//
// Stripslashes if need be
if (get_magic_quotes_gpc())
{
   $data = stripslashes($data);
}

// escape
$data = mysql_real_escape_string($data);

echo $data;
////////////////////////////////////////////////////////////////////////////

You will see that the data has become 'Hhi', the '\' has been stripped, 
and the data is no longer saved as expected.

If I turn magic_quotes_gpc=off this is a moot point.
But I was wondering how you could get it to work with magic_quotes_gpc=On

Any suggestions? comments?

Thanks

Simon