More magic quotes questions

[Jon]

All,

Yes, it's more of the famous 'what do I do about magic_quotes' questions.
Anyways, here we go:

I've been a PHP developer for about a year now, and have grown to detest
magic_quotes for numerous reasons. So, in my applications now I simply use
..htaccess to turn magic_quotes_gp c off and I escape as needed from there.

My problem however has become what to do for FULLY portable applications.
I'm currently writing an XML-based PHP application that will be using a
MySQL backend, and going by my logic that I normally use (turning magic
quotes off via htaccess) I might run into some problems. Basically, this
application needs to be able to move to ANY hosting provider with very
little configuration.

So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()' check
and escape where magic quotes are off. This shouldn't cause a problem with
my own code because I've turned magic_quotes off anyways.

Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to pickup
the htaccess directive that turns them off, so it is always reported on.
This basically traps me into not being able to check if they're on or off,
or simply counting on them for my own application and leaving them on (I
have no access to the .ini to turn them off at all).

Worse yet, on the other side - if I go with my .htaccess and just always
turn them off like I have been doing, this will come back to bite me if we
have to put this application on an IIS server where turning them off is not
an option. From what I understand, there's no way to turn them off at
runtime.

Any ideas on the best way to handle this?

[Jerry Stuckle]

Re: More magic quotes questions

Jon wrote:[color=blue]
> All,
>
> Yes, it's more of the famous 'what do I do about magic_quotes' questions.
> Anyways, here we go:
>
> I've been a PHP developer for about a year now, and have grown to detest
> magic_quotes for numerous reasons. So, in my applications now I simply use
> .htaccess to turn magic_quotes_gp c off and I escape as needed from there.
>
> My problem however has become what to do for FULLY portable applications.
> I'm currently writing an XML-based PHP application that will be using a
> MySQL backend, and going by my logic that I normally use (turning magic
> quotes off via htaccess) I might run into some problems. Basically, this
> application needs to be able to move to ANY hosting provider with very
> little configuration.
>
> So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()' check
> and escape where magic quotes are off. This shouldn't cause a problem with
> my own code because I've turned magic_quotes off anyways.
>
> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to pickup
> the htaccess directive that turns them off, so it is always reported on.
> This basically traps me into not being able to check if they're on or off,
> or simply counting on them for my own application and leaving them on (I
> have no access to the .ini to turn them off at all).
>
> Worse yet, on the other side - if I go with my .htaccess and just always
> turn them off like I have been doing, this will come back to bite me if we
> have to put this application on an IIS server where turning them off is not
> an option. From what I understand, there's no way to turn them off at
> runtime.
>
> Any ideas on the best way to handle this?
>
>[/color]

I code for having them off, and look for hosting companies who have them turned
off. There are thousands of good ones who run that way.

Just like I don't host with companies who run with register_global s turned on.

Generally I need to ask them if it's off or on. And if they can't tell me
something this simple, it's time to run the other way!


--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Jon]

Re: More magic quotes questions


"Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
news:b7udnUj3nO pizMvZ4p2dnA@co mcast.com...[color=blue]
> Jon wrote:[color=green]
>> All,
>>
>> Yes, it's more of the famous 'what do I do about magic_quotes' questions.
>> Anyways, here we go:
>>
>> I've been a PHP developer for about a year now, and have grown to detest
>> magic_quotes for numerous reasons. So, in my applications now I simply
>> use .htaccess to turn magic_quotes_gp c off and I escape as needed from
>> there.
>>
>> My problem however has become what to do for FULLY portable applications.
>> I'm currently writing an XML-based PHP application that will be using a
>> MySQL backend, and going by my logic that I normally use (turning magic
>> quotes off via htaccess) I might run into some problems. Basically, this
>> application needs to be able to move to ANY hosting provider with very
>> little configuration.
>>
>> So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()'
>> check and escape where magic quotes are off. This shouldn't cause a
>> problem with my own code because I've turned magic_quotes off anyways.
>>
>> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to
>> pickup the htaccess directive that turns them off, so it is always
>> reported on. This basically traps me into not being able to check if
>> they're on or off, or simply counting on them for my own application and
>> leaving them on (I have no access to the .ini to turn them off at all).
>>
>> Worse yet, on the other side - if I go with my .htaccess and just always
>> turn them off like I have been doing, this will come back to bite me if
>> we have to put this application on an IIS server where turning them off
>> is not an option. From what I understand, there's no way to turn them off
>> at runtime.
>>
>> Any ideas on the best way to handle this?[/color]
>
> I code for having them off, and look for hosting companies who have them
> turned off. There are thousands of good ones who run that way.
>
> Just like I don't host with companies who run with register_global s turned
> on.
>
> Generally I need to ask them if it's off or on. And if they can't tell me
> something this simple, it's time to run the other way!
>
>
> --
> =============== ===
> Remove the "x" from my email address
> Jerry Stuckle
> JDS Computer Training Corp.
> jstucklex@attgl obal.net
> =============== ===[/color]

Yeah, but if I'm building a retail application there's really no choice on
the host.

[Gordon Burditt]

Re: More magic quotes questions

>> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to pickup[color=blue][color=green]
>> the htaccess directive that turns them off, so it is always reported on.
>> This basically traps me into not being able to check if they're on or off,
>> or simply counting on them for my own application and leaving them on (I
>> have no access to the .ini to turn them off at all).[/color][/color]

This is ugly, but I suspect it will work: include on each form a
hidden variable containing a value that will be mangled by magic_quotes.
Check to see if the value has been mangled. Act accordingly.
[color=blue][color=green]
>> Any ideas on the best way to handle this?
>>[/color]
>I code for having them off, and look for hosting companies who have them turned
>off. There are thousands of good ones who run that way.
>
>Just like I don't host with companies who run with register_global s turned on.[/color]

Speaking of register_global s, when is ini_get('regist er_globals') going
to become a fatal error?

Gordon L. Burditt

[Jerry Stuckle]

Re: More magic quotes questions

Jon wrote:[color=blue]
> "Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
> news:b7udnUj3nO pizMvZ4p2dnA@co mcast.com...
>[color=green]
>>Jon wrote:
>>[color=darkred]
>>>All,
>>>
>>>Yes, it's more of the famous 'what do I do about magic_quotes' questions.
>>>Anyways, here we go:
>>>
>>>I've been a PHP developer for about a year now, and have grown to detest
>>>magic_quot es for numerous reasons. So, in my applications now I simply
>>>use .htaccess to turn magic_quotes_gp c off and I escape as needed from
>>>there.
>>>
>>>My problem however has become what to do for FULLY portable applications.
>>>I'm currently writing an XML-based PHP application that will be using a
>>>MySQL backend, and going by my logic that I normally use (turning magic
>>>quotes off via htaccess) I might run into some problems. Basically, this
>>>applicatio n needs to be able to move to ANY hosting provider with very
>>>little configuration.
>>>
>>>So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()'
>>>check and escape where magic quotes are off. This shouldn't cause a
>>>problem with my own code because I've turned magic_quotes off anyways.
>>>
>>>Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to
>>>pickup the htaccess directive that turns them off, so it is always
>>>reported on. This basically traps me into not being able to check if
>>>they're on or off, or simply counting on them for my own application and
>>>leaving them on (I have no access to the .ini to turn them off at all).
>>>
>>>Worse yet, on the other side - if I go with my .htaccess and just always
>>>turn them off like I have been doing, this will come back to bite me if
>>>we have to put this application on an IIS server where turning them off
>>>is not an option. From what I understand, there's no way to turn them off
>>>at runtime.
>>>
>>>Any ideas on the best way to handle this?[/color]
>>
>>I code for having them off, and look for hosting companies who have them
>>turned off. There are thousands of good ones who run that way.
>>
>>Just like I don't host with companies who run with register_global s turned
>>on.
>>
>>Generally I need to ask them if it's off or on. And if they can't tell me
>>something this simple, it's time to run the other way!
>>
>>
>>--
>>============= =====
>>Remove the "x" from my email address
>>Jerry Stuckle
>>JDS Computer Training Corp.
>>jstucklex@att global.net
>>============= =====[/color]
>
>
> Yeah, but if I'm building a retail application there's really no choice on
> the host.
>
>[/color]

Why not? There are always choices for hosts, unless they are planning to do it
in house. And if that's the case they can control the settings themselves.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Chung Leong]

Re: More magic quotes questions

Jon wrote:[color=blue]
> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to pickup
> the htaccess directive that turns them off, so it is always reported on.
> This basically traps me into not being able to check if they're on or off,
> or simply counting on them for my own application and leaving them on (I
> have no access to the .ini to turn them off at all).[/color]

Are you sure your observation is correct? get_magic_quote s_gpc()
returns the variable that controls whether slashes are added or not. If
it returns true, then magic_quotes_gp c is on. If it returns false, then
it's off--unless you alter the state through ini_set() afterward, of
course.
[color=blue]
>From the source code:[/color]

PHP_FUNCTION(ge t_magic_quotes_ gpc)
{
RETURN_LONG(PG( magic_quotes_gp c));
}

if (PG(magic_quote s_gpc)) {
Z_STRVAL(new_en try) = php_addslashes( strval, Z_STRLEN(new_en try),
&Z_STRLEN(new_e ntry), 0 TSRMLS_CC);
} else {
Z_STRVAL(new_en try) = estrndup(strval , Z_STRLEN(new_en try));
}

[Jon]

Re: More magic quotes questions


"Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
news:F46dnY_e_u y8HcvZnZ2dnUVZ_ tGdnZ2d@comcast .com...[color=blue]
> Jon wrote:[color=green]
>> "Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
>> news:b7udnUj3nO pizMvZ4p2dnA@co mcast.com...
>>[color=darkred]
>>>Jon wrote:
>>>
>>>>All,
>>>>
>>>>Yes, it's more of the famous 'what do I do about magic_quotes'
>>>>questions . Anyways, here we go:
>>>>
>>>>I've been a PHP developer for about a year now, and have grown to detest
>>>>magic_quote s for numerous reasons. So, in my applications now I simply
>>>>use .htaccess to turn magic_quotes_gp c off and I escape as needed from
>>>>there.
>>>>
>>>>My problem however has become what to do for FULLY portable
>>>>application s. I'm currently writing an XML-based PHP application that
>>>>will be using a MySQL backend, and going by my logic that I normally use
>>>>(turning magic quotes off via htaccess) I might run into some problems.
>>>>Basically , this application needs to be able to move to ANY hosting
>>>>provider with very little configuration.
>>>>
>>>>So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()'
>>>>check and escape where magic quotes are off. This shouldn't cause a
>>>>problem with my own code because I've turned magic_quotes off anyways.
>>>>
>>>>Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to
>>>>pickup the htaccess directive that turns them off, so it is always
>>>>reported on. This basically traps me into not being able to check if
>>>>they're on or off, or simply counting on them for my own application and
>>>>leaving them on (I have no access to the .ini to turn them off at all).
>>>>
>>>>Worse yet, on the other side - if I go with my .htaccess and just always
>>>>turn them off like I have been doing, this will come back to bite me if
>>>>we have to put this application on an IIS server where turning them off
>>>>is not an option. From what I understand, there's no way to turn them
>>>>off at runtime.
>>>>
>>>>Any ideas on the best way to handle this?
>>>
>>>I code for having them off, and look for hosting companies who have them
>>>turned off. There are thousands of good ones who run that way.
>>>
>>>Just like I don't host with companies who run with register_global s
>>>turned on.
>>>
>>>Generally I need to ask them if it's off or on. And if they can't tell
>>>me something this simple, it's time to run the other way!
>>>
>>>
>>>--
>>>============ ======
>>>Remove the "x" from my email address
>>>Jerry Stuckle
>>>JDS Computer Training Corp.
>>>jstucklex@at tglobal.net
>>>============ ======[/color]
>>
>>
>> Yeah, but if I'm building a retail application there's really no choice
>> on the host.[/color]
>
> Why not? There are always choices for hosts, unless they are planning to
> do it in house. And if that's the case they can control the settings
> themselves.
>[/color]

Because when we sell it we won't know what host the customer has. We'll
install it on other hosts if they give us the username/password to login to
the server and meet the requirements of PHP 4.x+ and MySQL 3.23+. We can't
really ask them to switch hosts.

[Jon]

Re: More magic quotes questions

I went back and re-tested it, and it is in fact returning true despite my
htaccess explicitly turing magic_quotes off.

"Chung Leong" <chernyshevsky@ hotmail.com> wrote in message
news:1146525708 .253074.185500@ u72g2000cwu.goo glegroups.com.. .[color=blue]
> Jon wrote:[color=green]
>> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to
>> pickup
>> the htaccess directive that turns them off, so it is always reported on.
>> This basically traps me into not being able to check if they're on or
>> off,
>> or simply counting on them for my own application and leaving them on (I
>> have no access to the .ini to turn them off at all).[/color]
>
> Are you sure your observation is correct? get_magic_quote s_gpc()
> returns the variable that controls whether slashes are added or not. If
> it returns true, then magic_quotes_gp c is on. If it returns false, then
> it's off--unless you alter the state through ini_set() afterward, of
> course.
>[color=green]
>>From the source code:[/color]
>
> PHP_FUNCTION(ge t_magic_quotes_ gpc)
> {
> RETURN_LONG(PG( magic_quotes_gp c));
> }
>
> if (PG(magic_quote s_gpc)) {
> Z_STRVAL(new_en try) = php_addslashes( strval, Z_STRLEN(new_en try),
> &Z_STRLEN(new_e ntry), 0 TSRMLS_CC);
> } else {
> Z_STRVAL(new_en try) = estrndup(strval , Z_STRLEN(new_en try));
> }
>[/color]

[Chung Leong]

Re: More magic quotes questions

Jon wrote:[color=blue]
> I went back and re-tested it, and it is in fact returning true despite my
> htaccess explicitly turing magic_quotes off.[/color]

Are slashes inserted though? Based on the source code, I just don't see
how it's possible that magic quote is off while get_magic_quote s_gpc()
returns true. It could be a bug, of course. If you post your test code
along with the line in the .htaccess, I'll trace through the scenario
under a debugger.

[Jambalaya]

Re: More magic quotes questions

Jon wrote:[color=blue]
> All,
>
> Yes, it's more of the famous 'what do I do about magic_quotes' questions.
> Anyways, here we go:
>
> I've been a PHP developer for about a year now, and have grown to detest
> magic_quotes for numerous reasons. So, in my applications now I simply use
> .htaccess to turn magic_quotes_gp c off and I escape as needed from there.
>
> My problem however has become what to do for FULLY portable applications.
> I'm currently writing an XML-based PHP application that will be using a
> MySQL backend, and going by my logic that I normally use (turning magic
> quotes off via htaccess) I might run into some problems. Basically, this
> application needs to be able to move to ANY hosting provider with very
> little configuration.
>
> So I thought "Hmm, ok, well I'll just run a 'get_magic_quot es_gpc()' check
> and escape where magic quotes are off. This shouldn't cause a problem with
> my own code because I've turned magic_quotes off anyways.
>
> Problem is the 'get_magic_quot es_gpc()' function doesn't seem able to pickup
> the htaccess directive that turns them off, so it is always reported on.
> This basically traps me into not being able to check if they're on or off,
> or simply counting on them for my own application and leaving them on (I
> have no access to the .ini to turn them off at all).
>
> Worse yet, on the other side - if I go with my .htaccess and just always
> turn them off like I have been doing, this will come back to bite me if we
> have to put this application on an IIS server where turning them off is not
> an option. From what I understand, there's no way to turn them off at
> runtime.
>
> Any ideas on the best way to handle this?[/color]

if (get_magic_quot es_gpc()){
function undoAddSlashes( $formval){
return stripslashes($f ormval);
}
} else {
function undoAddSlashes( $formval){
return $formval;
}
}

When accessing GPC data I *always* run it through undoAddSlashes.
Depending on whether magic quotes is active, undoAddSlashes will
perform the stripslashes. No wondering which to do or ini_set (which
doesn't work with magic quotes anyway, since by the time your ini_set
fires it has already added the slashes)

[Wayne]

Re: More magic quotes questions

On Mon, 1 May 2006 11:43:39 -0500, "Jon" <jonra@netins.c om> wrote:
[color=blue]
>Any ideas on the best way to handle this?[/color]

Don't use .htaccess to turn off magic quotes. If your code is setup
to escape the strings depending on whether or not it's enabled then it
shouldn't matter if magic quotes is enabled. I've never had the
get_magic_quote s_gpc() function return an incorrect value but then I
don't ever use .htaccess to set that magic_quotes_gp c setting.