write a custom function to handle this situation as another comment suggests) when magic_quotes_sybase is enabled. Stripslashes() is also magic_quotes_sybase aware, so you don't need to do anything special (ie. You should only stripslashes() when magic_quotes_gpc is enabled since that is the only time when slashes are automatically added. If magic_quotes_gpc is not enabled then magic_quotes_sybase will have no effect here.Ī few of the other comments are therefore incorrect in determining when to "stripslashes" from the input, by "stripping slashes" when either magic_quotes_gpc OR magic_quotes_sybase is enabled. magic_quotes_sybase will only override the escaping method used on Get/Post/Cookie data if magic_quotes_gpc is already enabled. > "If the directive magic_quotes_sybase is ON it will completely override magic_quotes_gpc." I was unable to compress the decision table more than this. Sorry for this huge amount of text, but it's complete. Maybe someone is willing to test those combinations for other php-versions and with magic_quotes_sybase set to 'on' - let me know. = The following function will strip GPC-arrays for php 5.0.2 = $decodedValue = ( $isMagic )? stripslashes ( $value ): $value $decodedValue = transcribe ( $value, false ) $decodedKey = ( $isMagic & ! $aIsTopLevel )? stripslashes ( $key ): $key = The following function will strip GPC-arrays for php 4.3.9 =
When running under php 5.0.2 having magic quotes disabled, gpc-keys on top level containing strings are escaped while their associated values are not. = here we go - the following rules apply =ġ7) The chars '.', ' ' are always replaced by '_' when used in keys. VE = value is returned as submitted and needn't to be stripped +VE = control chars are prefixed with a backslash VE = ValueEscaping (doesn't apply for array as value) KE = key is returned as submitted and needn't to be stripped +KE = control chars are prefixed with a backslash +AK = the value of the key is another array (i.e. TL = key is nested within another array (i.e.
= legend for possible case combinations = I did not test the behavior for cases where magic_quotes_sybase is set. I hope other arrays affected by magic quotes behave equally. The following is true for $_GET- and $_POST-arrays. Hope this saves someones time and nerves. It took me over 2 days of testing to figure out the exact behavior and creating two functions (one for each php-version) that strips slashes reliably from any array submitted to a script. After I saw escaped keys, I assumed they're escaped according to the settings of magic quotes. Note that the `foreach` style makes this work only with PHP 5 and above.Įscaping of key-strings in GPC-arrays behave different to the escaping of their values.įirst I expected that keys in submitted gpc-arrays are never escaped.Īnyway. Replaces two single-quotes with one if magic_quotes_sybase are on, otherwise it just strips slashes.
Here's what I came up with to remove magic quotes from request data. Getting Started Introduction A simple tutorial Language Reference Basic syntax Types Variables Constants Expressions Operators Control Structures Functions Classes and Objects Namespaces Enumerations Errors Exceptions Fibers Generators Attributes References Explained Predefined Variables Predefined Exceptions Predefined Interfaces and Classes Context options and parameters Supported Protocols and Wrappers Security Introduction General considerations Installed as CGI binary Installed as an Apache module Session Security Filesystem Security Database Security Error Reporting User Submitted Data Hiding PHP Keeping Current Features HTTP authentication with PHP Cookies Sessions Dealing with XForms Handling file uploads Using remote files Connection handling Persistent Database Connections Command line usage Garbage Collection DTrace Dynamic Tracing Function Reference Affecting PHP's Behaviour Audio Formats Manipulation Authentication Services Command Line Specific Extensions Compression and Archive Extensions Cryptography Extensions Database Extensions Date and Time Related Extensions File System Related Extensions Human Language and Character Encoding Support Image Processing and Generation Mail Related Extensions Mathematical Extensions Non-Text MIME Output Process Control Extensions Other Basic Extensions Other Services Search Engine Extensions Server Specific Extensions Session Extensions Text Processing Variable and Type Related Extensions Web Services Windows Only Extensions XML Manipulation GUI Extensions Keyboard Shortcuts ? This help j Next menu item k Previous menu item g p Previous man page g n Next man page G Scroll to bottom g g Scroll to top g h Goto homepage g s Goto search
0 kommentar(er)
