magic-quotes

PHP: how to (correctly) remove escaped quotes in arrays when Magic Quotes are ON

由 一笑奈何 提交于 2019-12-10 04:04:06
问题 As you know when Magic Quotes are ON, single quotes are escaped in values and also in keys. Most solutions to remove Magic Quotes at runtime only unescape values, not keys. I'm seeking a solution that will unescape keys and values... I found out on PHP.net this piece of code: $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST); while (list($key, $val) = each($process)) { foreach ($val as $k => $v) { unset($process[$key][$k]); if (is_array($v)) { $process[$key][stripslashes($k)] = $v;

Using get_magic_quotes_gpc on PHP Version 5.2.14 or equivalent for PHP Version 6

由 爷，独闯天下 提交于 2019-12-06 16:42:10
Our site is using PHP Version 5.2.14 Lately our hoster probably changed magic-quote defenition, and I came up with the suggested solution [code bellow] Is this solution OK for PHP Version 5.2.14 ? What should I change when we upgrade to PHP version 6 ? // Code: function fHandleQuotes($s) { if (get_magic_quotes_gpc()) return ($s); return (addslashes($s)); } . . . // Usage: . . . $query = "UPDATE myTable SET myField = '" . fHandleQuotes($_POST['fieldName']) . "'"; . . . In PHP 6 magic_quotes will be removed! Now you can use this function. if( ( function_exists("get_magic_quotes_gpc") && get

Understanding input escaping in PHP

由 前提是你 提交于 2019-12-05 16:04:40
One thing that's always confused me is input escaping and whether or not you're protected from attacks like SQL injection. Say I have a form which sends data using HTTP POST to a PHP file. I type the following in an input field and submit the form: "Hello", said Jimmy O'Toole. If you print/echo the input on the PHP page that receives this POST data, it comes out as: \"Hello\", said Jimmy O\'Toole. This is the point where it gets confusing. If I put this input string into (My)SQL and execute it, it'll go into the database fine (since quotes are escaped), but would that stop SQL injection? If I

What are magic quotes runtime in PHP?

由 ≡放荡痞女 提交于 2019-12-05 01:51:46
I'm totally aware of the aberration of Magic Quotes in PHP, how it is evil and I avoid them like pest, but what are magic_quotes_runtime ? From php.ini: Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. Is is something I should check if ON and turn OFF with: set_magic_quotes_runtime(false); Is it often ON by default? I know it's deprecated in 5.3.0 and removed in 6.0.0 but since my script support 5.1.0+ I would like to know how to handle this in "legacy" PHP (if it's relevant). Edit: To make things clear I want to exit('Turn OFF Magic Quotes'); when Magic quotes

Mysql Real Escape String PHP Function Adding “\” to My Field Entry

由 亡梦爱人 提交于 2019-11-29 21:17:50
问题 I am submitting a form to my MySQL database using PHP. I am sending the form data through the mysql_real_escape_string($content) function. When the entry shows up in my database (checking in phpMyAdmin) all of my double quotes and single quotes are escaped. I'm fairly certain this is a PHP configuration issue? so: $content = 'Hi, my name is Jascha and my "favorite" thing to do is sleep'; mysql_real_escape_string($content); $query = 'INSERT INTO DB...' comes up in my database as: Hi, my name

How to turn off magic quotes in PHP configuration file? I am using XAMPP

由 …衆ロ難τιáo~ 提交于 2019-11-29 17:46:32
What is the file? I have php.ini and php.ini-dist on my computer. php.ini-dist is the sample config file that comes with PHP, php.ini is the live config so you will need to set in this file magic_quotes_gpc = off magic_quotes_runtime = off magic_quotes_sybase = off 来源： https://stackoverflow.com/questions/1748001/how-to-turn-off-magic-quotes-in-php-configuration-file-i-am-using-xampp

How to turn off magic quotes in PHP configuration file? I am using XAMPP

由 故事扮演 提交于 2019-11-28 12:52:04
问题 What is the file? I have php.ini and php.ini-dist on my computer. 回答1: php.ini-dist is the sample config file that comes with PHP, php.ini is the live config so you will need to set in this file magic_quotes_gpc = off magic_quotes_runtime = off magic_quotes_sybase = off 来源： https://stackoverflow.com/questions/1748001/how-to-turn-off-magic-quotes-in-php-configuration-file-i-am-using-xampp

PHP - Shorter Magic Quotes Solution

由 天大地大妈咪最大 提交于 2019-11-28 12:22:39
问题 I'm writing a app that needs to be portable. I know I should disable magic quotes on the PHP configuration but in this case I don't know if I can do that, so I'm using the following code: if (get_magic_quotes_gpc() === 1) { $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST); while (list($key, $val) = each($process)) { foreach ($val as $k => $v) { unset($process[$key][$k]); if (is_array($v)) { $process[$key][stripslashes($k)] = $v; $process[] = &$process[$key][stripslashes($k)]; } else {

PHP 5.3 automatically escapes $_GET/$_POST from form strings?

由 百般思念 提交于 2019-11-28 01:17:53
My server admin recently upgraded to PHP 5.3 and I'm getting a weird "bug" (or feature , as the PHP folks have it). I had mysql_real_escape_string around most of my string form data for obvious safety reasons, but now it seems this escaping is already done by PHP. <?php echo $_GET["escaped"]; ?> <form method="get"> <input type="text" name="escaped" /> </form> This outputs, if I enter for instance escape 'this test' , escape \'this test\' . Same goes if I use POST instead of GET . Is it directly tied to the 5.3 upgrade or could my admin have triggered some automatic switch in the php.ini file?

How can I disable PHP magic quotes at runtime?

由 百般思念 提交于 2019-11-27 15:34:19
I'm writing a set of PHP scripts that'll be run in some different setups, some of them shared hosting with magic quotes on (the horror). Without the ability to control PHP or Apache configuration, can I do anything in my scripts to disable PHP quotes at runtime? It'd be better if the code didn't assume magic quotes are on, so that I can use the same scripts on different hosts that might or might not have magic quotes. Only magic_quoted_runtime can be disabled at runtime. But magic_quotes_gpc can’t be disabled at runtime ( PHP_INI_ALL changable until PHP 4.2.3, since then PHP_INI_PERDIR ); you
订阅 magic-quotes