I'm Coming Back as I\'m - why?

[Ralph Freshour]

When I send text in a textbox to the server and retrieve into a PHP
var, I'm comes back as I\'m - what is causing this slash and how can I
get rid of it?

Thanks...

[Alan Little]

Re: I'm Coming Back as I\'m - why?

Carved in mystic runes upon the very living rock, the last words of Ralph
Freshour of comp.lang.php make plain:
[color=blue]
> When I send text in a textbox to the server and retrieve into a PHP
> var, I'm comes back as I\'m - what is causing this slash and how can I
> get rid of it?[/color]

You have magic_quotes_gp c turned on in your PHP config. Turn it off.

--
Alan Little
Phorm PHP Form Processor

http://www.phorm.com/

[Geoff Berrow]

Re: I'm Coming Back as I\'m - why?

I noticed that Message-ID: <Xns941CED51B27 C4alanphormcom@ 216.196.97.132>
from Alan Little contained the following:
[color=blue][color=green]
>> When I send text in a textbox to the server and retrieve into a PHP
>> var, I'm comes back as I\'m - what is causing this slash and how can I
>> get rid of it?[/color]
>
>You have magic_quotes_gp c turned on in your PHP config. Turn it off.[/color]

Actually, don't.

Use stripslashes($t extbox_var)

--
Geoff Berrow
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Jim Dabell]

Re: I'm Coming Back as I\'m - why?

Geoff Berrow wrote:
[color=blue]
> I noticed that Message-ID: <Xns941CED51B27 C4alanphormcom@ 216.196.97.132>
> from Alan Little contained the following:
>[color=green][color=darkred]
>>> When I send text in a textbox to the server and retrieve into a PHP
>>> var, I'm comes back as I\'m - what is causing this slash and how can I
>>> get rid of it?[/color]
>>
>>You have magic_quotes_gp c turned on in your PHP config. Turn it off.[/color]
>
> Actually, don't.
>
> Use stripslashes($t extbox_var)[/color]

Why? Surely it's better to not convert the input data in the first place
unless required? I've never understood the reasoning behind it defaulting
to on.

--
Jim Dabell

[Geoff Berrow]

Re: I'm Coming Back as I\'m - why?

I noticed that Message-ID: <Msmdnb4IYa7qPQ qiRVn-gA@giganews.com > from
Jim Dabell contained the following:
[color=blue][color=green][color=darkred]
>>>You have magic_quotes_gp c turned on in your PHP config. Turn it off.[/color]
>>
>> Actually, don't.
>>
>> Use stripslashes($t extbox_var)[/color]
>
>Why? Surely it's better to not convert the input data in the first place
>unless required? I've never understood the reasoning behind it defaulting
>to on.[/color]

The chap is probably a newbie. Best to play safe.

--
Geoff Berrow
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Daniel Tryba]

Re: I'm Coming Back as I\'m - why?

Geoff Berrow <blthecat@ckdog .co.uk> wrote:[color=blue][color=green][color=darkred]
>>>>You have magic_quotes_gp c turned on in your PHP config. Turn it off.
>>> Actually, don't.[/color]
>>Why?[/color]
> The chap is probably a newbie. Best to play safe.[/color]

Please explain why you think magic_quotes_gp c would increase safety?

--

Daniel Tryba

[Pham Nuwen]

Re: I'm Coming Back as I\'m - why?

Daniel Tryba wrote:
[color=blue]
> Geoff Berrow <blthecat@ckdog .co.uk> wrote:
>[color=green][color=darkred]
>>>>>You have magic_quotes_gp c turned on in your PHP config. Turn it off.
>>>>
>>>>Actually, don't.
>>>
>>>Why?[/color]
>>
>>The chap is probably a newbie. Best to play safe.[/color]
>
>
> Please explain why you think magic_quotes_gp c would increase safety?
>[/color]

unescaped special characters in a string can be used to send arbitrary
code to the server. this is dangerous in many ways if exploited
correctly it can most definitely represent a security breach.

for example if I know the string is used to run a command line process
with say something like :

exec("ls $dir", $dirlist, $error );

I can pass it a string that will do anything I want. You may think it is
limited to a "ls" command, but just see what happens if I send it a
string like this " joe; touch myfile; cat ~/.bash_history; rm
~/.bash_history"

see suddenly I have all sorts of control I shouldn't. The similar things
can be done with fields going to a database, by sending it a "';" to
end one SQL command and start sending others...

--
/---+----+----+----+----+----+----++----+----+----+----+----+----+---\
I pham.nuwen3d6@l ibertydice.org II No nation was ever ruined by I
I http://www.libertydice.org II trade, even seemingly the most I
I remove "3d6" to e-mail II disadvantageous . - Ben Franklin I
\---+----+----+----+----+----+----++----+----+----+----+----+----+---/

[Daniel Tryba]

Re: I'm Coming Back as I\'m - why?

Pham Nuwen <pham.nuwen3d6@ libertydice.org > wrote:[color=blue][color=green][color=darkred]
>>>The chap is probably a newbie. Best to play safe.[/color]
>> Please explain why you think magic_quotes_gp c would increase safety?
>>[/color]
>
> unescaped special characters in a string can be used to send arbitrary
> code to the server. this is dangerous in many ways if exploited
> correctly it can most definitely represent a security breach.[/color]
[ls exanple][color=blue]
> see suddenly I have all sorts of control I shouldn't. The similar things
> can be done with fields going to a database, by sending it a "';" to
> end one SQL command and start sending others...[/color]

You prove the point of disabling magic_quotes_gp c exactly. The ls example
shows that all kind of characters have to be escaped (like (but propable
not limited to) ';', '*', '/', '?').

An other example is the use of textarea's (like the OP(?)), you have to
html escape the users input (including quotes) when displaying it again
in a browser.

IMHO magic_quotes_gp c lulls the user into thinking the data is safe. The
escaping of characters is very important and what to escape is
different for all kinds of use, but no magic_*_escape_ thingy exists for
most.

--

Daniel Tryba

[Alan Little]

Re: I'm Coming Back as I\'m - why?

Carved in mystic runes upon the very living rock, the last words of Pham
Nuwen of comp.lang.php make plain:
[color=blue]
> Daniel Tryba wrote:
>
> see suddenly I have all sorts of control I shouldn't. The similar
> things can be done with fields going to a database, by sending it a
> "';" to end one SQL command and start sending others...[/color]

I've tried that with MySQL (on my own databases, of course!) and it doesn't
work. I'm only able to send one query at a time.

--
Alan Little
Phorm PHP Form Processor

http://www.phorm.com/