[RESOLVED] Magic Quotes

Derokorian

Ok so I made this site about a year ago, and the server didn't have magic quotes turned on. It's a shared server so I don't have a lot of control over the configuration for them, however the host (GoDaddy whom I really really hate lately) apparently turned them on recently, now everytime they try to update content or add more there are slashes everywhere!! I know I can use if( get_magic_quotes_gpc() ) { stripslashes($input); } but I was wondering if there was an easy way to do this to all post data automatically instead stripping every field separately. Would be this be acceptable or is there a better solution:

// In first included file for each page
if( get_magic_quotes_gpc() ) {
   foreach( $_POST as $k => $v ) {
      $_POST[$k] = stripslashes($v);
   }
}

That way I wouldn't have to update every single form on the site, just add this include to the top of my page building index file?

NogDog

This is what I use. (If you ever use the $REQUEST array, you'll want to add it to the others.)

<?php
/**
 * Undo the damage of magic_quotes_gpc if in effect
 * @return bool
 */
function fix_magic_quotes()
{
   if (get_magic_quotes_gpc()) {
      $func = create_function(
         '&$val, $key',
         'if(!is_numeric($val)) {$val = stripslashes($val);}'
      );
      array_walk_recursive($_GET, $func);
      array_walk_recursive($_POST, $func);
      array_walk_recursive($_COOKIE, $func);
   }
   return true;
}

Derokorian

omg MQ effects get and cookie? does it also effect session?

This is why I refuse to ever enable it on my servers 🙁 But the customer wanted to be on GoDaddy so that's what they get... to pay me more money to fix something that shouldn't be broken XD

I don't quite understand what you showed me, why put this in a function and not just remove the function definition and call everything inside the function? since its always in a mq conditional it will only get called as needed.

NogDog

the "gpc" part of "magic_quotes_gpc" stands for Get, Post, and Cookie; so no, it does not affect sessions. 🙂

I just put everything in a function to make it portable: you can put it in an include file of other functions, etc., and then just call it from your main script. But if you want to use it differently, by all means do what works for you; e.g., just copy everything between the function definition curly braces, and paste it into your config.php script if you use one, for example.

Derokorian

Well I have a load file, that sets errors for environment (display on/off, handler, log on/off + location), includes other files (like function files, and config files) so I guess this would fall under "sets up the environment" =D Thanks so much I didn't know what it stood for I always configure without it =D