Magic Quotes - how do I work around them?

mrprpl

Hi guys.
I'm developing a simple content management system for a client, and I need to post data to a script which then writes it to a file. However, I don't have access to the config files on the server (it's a shared host) and I'm going insane with the whole "magic quotes" thing. They mess up any HTML code they get their hands on by escaping all the quotes. It's really irritating.

I've tried using stripslashes() to counter the effect, which had some success, but then it would over-zealously remove slashes that were meant to be there.

Does anyone know of a reliable method to keep submitted data un-Magic-quoted? It's driving me nuts!

Cheers in advance

Alias

rapmonkey

Can I see some a line or two of the code so i can see exactly what you mean? Also show me where your problem is.

tsigo

http://www.php.net/manual/en/function.set-magic-quotes-runtime.php

Turn magic quotes off using set_magic_quotes_runtime(0)

d-woo

Since you do not have access to the config files....

If you are on a *nix server (non-Windows) then you might add an .htacess file with the following line

php_flag magic_quotes_gpc off

That should do it!

If that does't work, use the above posts' code in the .htaccess file

Let us know if it worked!

Weedpacket

Originally posted by d-woo
Since you do not have access to the config files....

If you are on a *nix server (non-Windows) then you might add an .htacess file with the following line

That should do it!

If that does't work, use the above posts' code in the .htaccess file

Let us know if it worked!

But without access to the config files (on a shared host) .htaccess is probably just as much out of reach as php.ini. The function referred to in the previous post is a PHP function that goes in the PHP script. No messing with any config files (PHP's or the server's).

SKennedy

This was the solution I came up with. It goes in my common.inc file, which is included in all my scripts.

function RemoveMagic( &$BadMojo )
{
  if( is_array( $BadMojo ) )
  {
    reset( $BadMojo );
    while( list( $key, $val ) = each( $BadMojo ) )
    {
      if( is_array( $BadMojo["$key"] ) )
        RemoveMagic( $BadMojo["$key"] );
      else
        $BadMojo["$key"] = stripslashes( $val );
    }
  } else
    $BadMojo = stripslashes( $BadMojo );
}

And then I call it like this:

if( get_magic_quotes_gpc() )
{
  RemoveMagic( $_GET );
  RemoveMagic( $_POST );
  RemoveMagic( $_COOKIE );
}

sp0rk

ini_set is your friend when the admin has diffrent ideas about what default behaviour should be...

ini_set("magic_quotes_gpc",0);

Done. 😃

MrAlaska

You mentioned HTML code is giving your problems, have you tried htmlspcecialchars?

$message=trim(htmlspecialchars($message));

My home server has magic quotes on and the above codes lets anthing through and gets entered into the database as written. I have an opposite problem on my uploaded files. That server has magic quotes turned off so it breaks the SQL whenever somthing is submitted with a single quote. I need to add my own backslashes in my code in that case.

MrAlaska

Yikes, I don't know what the hell I was thinking, sleep deprivation must be getting to me. htmlspecialchars will NOT enter it into the database as written, it turns all the code into character codes so you can display them back on an HTML page. If you are trying to generate HTML from your database, it is not the solution for you at all.

SKennedy

Originally posted by sp0rk
ini_set is your friend when the admin has diffrent ideas about what default behaviour should be...
ini_set("magic_quotes_gpc",0);
Done. 😃 [/B]

This is why this technique is not used:

magic_quotes_gpc is another setting that when changed has no effect on your script at all. This is because the variables in $POST/$GET/$_COOKIE are already setup by the time you are able to call ini_set()

And here's the linky where I found that: http://www.php.net/manual/en/function.ini-set.php

sp0rk

I was prepared to call BS on that since I "know" it has worked for me in the past... but as it turns out the admin where some of my work is hosted changed that setting after my inquery about it being enabled and didn't tell me...

And here I was thinking that was a valid workaround, how embarrassing. :rolleyes:

SKennedy

Originally posted by sp0rk
I was prepared to call BS on that since I "know" it has worked for me in the past... but as it turns out the admin where some of my work is hosted changed that setting after my inquery about it being enabled and didn't tell me...

And here I was thinking that was a valid workaround, how embarrassing. :rolleyes:

Don't be embarrassed, I thought the same thing for a while. A long while, because most of my code is tested on my home machines, which have it off by default. I never actually did any tests on my remote host, which has it on by default.