PHP 5.6.0 released

Desabilitando Magic Quotes

A diretiva magic_quotes_gpc só pode ser desabilita em nível de sistema, e não em tempo de execução. Em outras palavras, uso da função ini_set() não é uma opção.

Exemplo #1 Desabilitando magic quotes no lado do servidor

Um exemplo que configuração dessa diretiva para Off (Desligada) no arquivo php.ini. Para detalhes adicionais, leia a seção do manual entitulada Como mudar os valores das configurações.

; Magic quotes
;

; Magic quotes para dados vindos via GET/POST/Cookie.
magic_quotes_gpc = Off

; Magic quotes para dados gerados em tempo de execução,ex.: dados vindo de SQL, de chamadas à exec(), etc.
magic_quotes_runtime = Off

; Usar magic quotes no estilo Sybase (escapar ' com '' ao invés de \').
magic_quotes_sybase = Off

Se acesso à configuração do servidor não estiver disponível, uso do arquivo .htaccess também é uma opção. Por exemplo:

php_flag magic_quotes_gpc Off

No interesse de escrever código portável (código que funciona em qualquer ambiente), como onde configurar a opção em nível de servidor não for possível, aqui está um exemplo de como desabilitar magic_quotes_gpc em tempo de execução. Esse método é ineficiente então é preferível configurar as diretivas apropriadas em outros lugares.

Exemplo #2 Desabilitando magic quotes em tempo de execução

<?php
if (get_magic_quotes_gpc()) {
    
$process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
    while (list(
$key$val) = each($process)) {
        foreach (
$val as $k => $v) {
            unset(
$process[$key][$k]);
            if (
is_array($v)) {
                
$process[$key][stripslashes($k)] = $v;
                
$process[] = &$process[$key][stripslashes($k)];
            } else {
                
$process[$key][stripslashes($k)] = stripslashes($v);
            }
        }
    }
    unset(
$process);
}
?>

add a note add a note

User Contributed Notes 9 notes

up
9
mike at mawdesign dot com
7 months ago
Here's a couple tips when using scripts on different (often shared) hosts, where ini_set doesn't work and php directives in .htaccess causes a 500 Internal Server Error.

Firstly, copy the server's php.ini file to your domain's web-root folder. To find the correct paths, use phpinfo() and look for "Configuration File (php.ini) Path" and "DOCUMENT_ROOT"

It's unlikely you'll have access to the php.ini via FTP, so instead run a script with a simple copy command (obviously inserting your paths):

exec("cp /usr/local/php/etc/php.ini /home/LinuxPackage/public_html/php.ini);

Edit the now-accessible php.ini file, and add settings like 'magic_quotes_gpc = off' at the bottom (regardless of whether they've been set earlier in the file). I also set:

[PHP]
max_execution_time = 60
max_input_time = 90
memory_limit = 64M
post_max_size = 32M
upload_max_filesize = 31M
magic_quotes_gpc = Off

Finally add the below line to your web-root htaccess file, to make the local php.ini the web-root default (so you don't need a copy in every script sub-folder):

SetEnv PHPRC /home/LinuxPackage/public_html/php.ini

Hope that helps a few people save some time!

Mike.

P.S. Using the new php_ini_loaded_file() function the whole lot could be done in three lines:

exec("cp " . php_ini_loaded_file() . " " . $_SERVER['DOCUMENT_ROOT'] . "/php.ini");
fwrite(fopen("{$_SERVER['DOCUMENT_ROOT']}/php.ini", 'a'), PHP_EOL . '[PHP]' . PHP_EOL . "magic_quotes_gpc = Off" . PHP_EOL);
fwrite(fopen("{$_SERVER['DOCUMENT_ROOT']}/.htaccess", 'a'), PHP_EOL . "SetEnv PHPRC {$_SERVER['DOCUMENT_ROOT']}/php.ini" . PHP_EOL);
up
12
booboogotu at gmail dot com
5 years ago
A php5 way:

<?php
if (get_magic_quotes_gpc()) {
    function
stripslashes_gpc(&$value)
    {
       
$value = stripslashes($value);
    }
   
array_walk_recursive($_GET, 'stripslashes_gpc');
   
array_walk_recursive($_POST, 'stripslashes_gpc');
   
array_walk_recursive($_COOKIE, 'stripslashes_gpc');
   
array_walk_recursive($_REQUEST, 'stripslashes_gpc');
}
?>
up
9
stuart at horuskol dot co dot uk
6 years ago
I have discovered that my host doesn't like either of the following directives in the .htaccess file:

php_flag magic_quotes_gpc Off
php_value magic_quotes_gpc Off

However, there is another way to disable this setting even if you don't have access to the server configuration - you can put a php.ini file in the directory where your scripts are with the directive:

magic_quotes_gpc = Off

However, these does not propogate unlike  .htaccess rules, so if you launch from a sub-directory, you need the php.ini file in each directory you have as script entry points.
up
2
rdk
7 years ago
The function parse_str() (http://us3.php.net/manual/en/function.parse-str.php) is also affected by magic_quotes_gpc, so if that function is called anywhere, stripslashes_deep won't be sufficient by itself.
up
3
dedlfix
8 years ago
The function stripslashes_deep() ignores slashes in the keys

For example a query string like this: ?foo'bar=baz'bal

Output of var_dump($_GET) is:

array(1) {
  ["foo\'bar"]=>
  string(8) "baz\'bal"
}

after stripslashes_deep():

array(1) {
  ["foo\'bar"]=>
  string(7) "baz'bal"
}

If you want the keys to be stripslashed too, you have to unset() the addslahed key and to add a stripslashed version. But keep in mind that this will change the order of the array.
up
1
Dan dot gill at hotmail dot com
7 months ago
These instructions are great.  And if you have a site with an integrated shopping cart, then you will need to copy PHP.ini from the root of your site to the root folder of your shopping cart - otherwise you will still get errors on your cart pages.
up
1
Anonymous
7 years ago
PHP's magic quotes function has the strange behavior of not adding slashes to top level keys in GPC key/value pairs but adding the slashes in deeper level keys. To demonstrate, a URI of:

example.php?a'b[c'd]=e'f
produces:
array("a'b" => array("c\'d" => "e\'f"))

The current example for removing magic quotes does not do anything to keys, so after running stripslashes_deep, you would end up with:
array("a'b" => array("c\'d" => "e'f"))

Which, needless to say, is wrong. As if you had magic quotes off, it would have been:
array("a'b" => array("c'd" => "e'f"))

I have written a snippet of code compatible with PHP 4.0.0 and above that handles this correctly:

if (get_magic_quotes_gpc()) {
    function undoMagicQuotes($array, $topLevel=true) {
        $newArray = array();
        foreach($array as $key => $value) {
            if (!$topLevel) {
                $key = stripslashes($key);
            }
            if (is_array($value)) {
                $newArray[$key] = undoMagicQuotes($value, false);
            }
            else {
                $newArray[$key] = stripslashes($value);
            }
        }
        return $newArray;
    }
    $_GET = undoMagicQuotes($_GET);
    $_POST = undoMagicQuotes($_POST);
    $_COOKIE = undoMagicQuotes($_COOKIE);
    $_REQUEST = undoMagicQuotes($_REQUEST);
}
up
0
metala at metala dot org
5 years ago
I have recently found out that magic quotes affects not only the values of the GPC arrays, but also the keys.

For now, my way to solve with the problem is:

<?php
if (get_magic_quotes_gpc()) {
    function
magicQuotes_awStripslashes(&$value, $key) {$value = stripslashes($value);}
   
$gpc = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
   
array_walk_recursive($gpc, 'magicQuotes_awStripslashes');
}
?>

Unfortunately it doesn't fix the keys... and cannot determinate if the slashes are already stripped.
up
-4
H Patel
7 months ago
i do not check for get_magic_quotes_gpc is on of off as we should remove all slashes. another thing is to remove slashes using strip slash will only remove "\" to "" and "\\" to "\"

To over come this problem i use str_replace(array( '\\'), '', $v)

Update Example 2
<?php

    $process
= array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
    while (list(
$key, $val) = each($process)) {
        foreach (
$val as $k => $v) {
            unset(
$process[$key][$k]);
            if (
is_array($v)) {
               
$process[$key][str_replace(array('\\'), '', $k)] = $v;
               
$process[] = &$process[$key][str_replace(array('\\'), '', $k)];
            } else {
               
$process[$key][str_replace(array('\\'), '', $k)] = str_replace(array('\\'), '', $v);
            }
        }
    }
    unset(
$process);

?>
To Top