I have recently found out that magic quotes affects not only the values of the GPC arrays, but also the keys.
For now, my way to solve with the problem is:
<?php
if (get_magic_quotes_gpc()) {
function magicQuotes_awStripslashes(&$value, $key) {$value = stripslashes($value);}
$gpc = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
array_walk_recursive($gpc, 'magicQuotes_awStripslashes');
}
?>
Unfortunately it doesn't fix the keys... and cannot determinate if the slashes are already stripped.
Отключение волшебных кавычек
Директиву magic_quotes_gpc можно отключить только на системном уровне и нельзя во время выполениня. В других случаях, использование ini_set() не дает эффекта.
Пример #1 Отключение волшебных кавычек на сервере
Пример, где показана установка значения Off в php.ini для этих директив. Для дополнительной информации читайте раздел руководства под названием Как изменять параметры конфигурации.
; Волшебные кавычки ; ; Волшебные кавычки для входных данных GET/POST/Cookie. magic_quotes_gpc = Off ; Волшебные кавычки для данных, поступающих во время выполнения (например, данные из SQL, из exec() и т.д). magic_quotes_runtime = Off ; Использование волшебных кавычек в стиле Sybase (экранирование ' путем '' вместо \'). magic_quotes_sybase = Off
Если доступ к конфигурации на сервере невозможен, используйте .htaccess в качестве альтернативы. Например:
php_flag magic_quotes_gpc Off
В целях написания переносимого кода (код, который будет работать на любой платформе), и в случае невозможности изменения конфигурации на сервере, показан пример отключения magic_quotes_gpc в скрипте. Этот метод неэффективен, так как предпочтительно устанавливать соответствующие директивы в другом месте.
Пример #2 Отключение волшебных кавычек в скрипте
<?php
if (get_magic_quotes_gpc()) {
function stripslashes_deep($value)
{
$value = is_array($value) ?
array_map('stripslashes_deep', $value) :
stripslashes($value);
return $value;
}
$_POST = array_map('stripslashes_deep', $_POST);
$_GET = array_map('stripslashes_deep', $_GET);
$_COOKIE = array_map('stripslashes_deep', $_COOKIE);
$_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}
?>
User Contributed Notes
Disabling Magic Quotes
Disabling Magic Quotes
metala at metala dot org
21-Jun-2009 10:38
21-Jun-2009 10:38
booboogotu at gmail dot com
17-Jun-2009 10:46
17-Jun-2009 10:46
A php5 way:
<?php
if (get_magic_quotes_gpc()) {
function stripslashes_gpc(&$value)
{
$value = stripslashes($value);
}
array_walk_recursive($_GET, 'stripslashes_gpc');
array_walk_recursive($_POST, 'stripslashes_gpc');
array_walk_recursive($_COOKIE, 'stripslashes_gpc');
array_walk_recursive($_REQUEST, 'stripslashes_gpc');
}
?>
stuart at horuskol dot co dot uk
25-Apr-2008 08:26
25-Apr-2008 08:26
I have discovered that my host doesn't like either of the following directives in the .htaccess file:
php_flag magic_quotes_gpc Off
php_value magic_quotes_gpc Off
However, there is another way to disable this setting even if you don't have access to the server configuration - you can put a php.ini file in the directory where your scripts are with the directive:
magic_quotes_gpc = Off
However, these does not propogate unlike .htaccess rules, so if you launch from a sub-directory, you need the php.ini file in each directory you have as script entry points.
17-Dec-2006 08:20
PHP's magic quotes function has the strange behavior of not adding slashes to top level keys in GPC key/value pairs but adding the slashes in deeper level keys. To demonstrate, a URI of:
example.php?a'b[c'd]=e'f
produces:
array("a'b" => array("c\'d" => "e\'f"))
The current example for removing magic quotes does not do anything to keys, so after running stripslashes_deep, you would end up with:
array("a'b" => array("c\'d" => "e'f"))
Which, needless to say, is wrong. As if you had magic quotes off, it would have been:
array("a'b" => array("c'd" => "e'f"))
I have written a snippet of code compatible with PHP 4.0.0 and above that handles this correctly:
if (get_magic_quotes_gpc()) {
function undoMagicQuotes($array, $topLevel=true) {
$newArray = array();
foreach($array as $key => $value) {
if (!$topLevel) {
$key = stripslashes($key);
}
if (is_array($value)) {
$newArray[$key] = undoMagicQuotes($value, false);
}
else {
$newArray[$key] = stripslashes($value);
}
}
return $newArray;
}
$_GET = undoMagicQuotes($_GET);
$_POST = undoMagicQuotes($_POST);
$_COOKIE = undoMagicQuotes($_COOKIE);
$_REQUEST = undoMagicQuotes($_REQUEST);
}
sunrunner20
25-Nov-2006 03:10
25-Nov-2006 03:10
If php_flag magic_quotes_gpc off does not work
Use php_value magic_quotes_gpc off
insteadin your .htaccess file
rdk
08-Sep-2006 06:44
08-Sep-2006 06:44
The function parse_str() (http://us3.php.net/manual/en/function.parse-str.php) is also affected by magic_quotes_gpc, so if that function is called anywhere, stripslashes_deep won't be sufficient by itself.
dedlfix
20-Aug-2006 12:18
20-Aug-2006 12:18
The function stripslashes_deep() ignores slashes in the keys
For example a query string like this: ?foo'bar=baz'bal
Output of var_dump($_GET) is:
array(1) {
["foo\'bar"]=>
string(8) "baz\'bal"
}
after stripslashes_deep():
array(1) {
["foo\'bar"]=>
string(7) "baz'bal"
}
If you want the keys to be stripslashed too, you have to unset() the addslahed key and to add a stripslashed version. But keep in mind that this will change the order of the array.