Ambiguous phrases in PHP Manual

[Ken in Melbourne Australia]

The PHP manual defines
"magic_quotes_runtime

If enabled, most functions that return data from an external
source, including databases and text files, will have quotes
escaped with a backslash "...

This term 'external source' isn't defined anywhere in the
manual! Is the data in our $_GET and $_POST variables
considered an external source? The term 'most functions'
without further explanation is most ambiguous.

If magic_quotes_gpc is set to off in the php.ini file, can
we control whether the $_GET and $_POST data is
automagically slashed using set_magic_quotes_runtime()?
or is magic_quotes_runtime only used for the data coming
out of our database or files and a few special uses?

Thanks for your help in sorting this confusion.

Ken

[Joe Webster]

"Ken in Melbourne Australia" <ke*@mira.net> wrote in message
news:42***********************@per-qv1-newsreader-01.iinet.net.au...

The PHP manual defines
"magic_quotes_runtime

If enabled, most functions that return data from an external
source, including databases and text files, will have quotes
escaped with a backslash "...

This term 'external source' isn't defined anywhere in the
manual! Is the data in our $_GET and $_POST variables
considered an external source? The term 'most functions'
without further explanation is most ambiguous.

If magic_quotes_gpc is set to off in the php.ini file, can
we control whether the $_GET and $_POST data is
automagically slashed using set_magic_quotes_runtime()?
or is magic_quotes_runtime only used for the data coming
out of our database or files and a few special uses?

Thanks for your help in sorting this confusion.

Ken

If magic_quotes is turned on (the last time I actually used it) I'm pretty
sure a form that a GET/POST request will be escaped to ease insertion into a
database for example. Coming out of a database such as mySQL, I don't think
I've ever seen them escaped.

IMO, it's bad practice to use/depend on magic_quotes being on.

HTH
-Joe

[Brion Vibber]

> "Ken in Melbourne Australia" <ke*@mira.net> wrote:

The PHP manual defines
"magic_quotes_runtime

If enabled, most functions that return data from an external
source, including databases and text files, will have quotes
escaped with a backslash "...

This term 'external source' isn't defined anywhere in the
manual! Is the data in our $_GET and $_POST variables
considered an external source? The term 'most functions'
without further explanation is most ambiguous.
Well, $_GET and $_POST are not functions. They are array variables.
If magic_quotes_gpc is set to off in the php.ini file, can
we control whether the $_GET and $_POST data is
automagically slashed using set_magic_quotes_runtime()?
or is magic_quotes_runtime only used for the data coming
out of our database or files and a few special uses?

You could test this question in much less time than it takes to ask a
question on usenet and wait for a response. :)

Because magic_quotes_runtime corrupts data with slashes coming from
various _unspecified_ functions, you should probably never, ever use
magic_quotes_runtime without doing a lot of careful testing.

For the array values, which are already present at the start of the
script, you must check whether magic_quotes_gpc is on and use
stripslashes() as appropriate to get the uncorrupted values of the
submitted data.

Always perform the appropriate escaping (eg with
mysql_real_escape_string()) before putting data into an SQL statement.

Joe Webster wrote: If magic_quotes is turned on (the last time I actually used it) I'm pretty
sure a form that a GET/POST request will be escaped to ease insertion into a
database for example.
That's magic_quotes_gpc, which is ON by default...
Coming out of a database such as mySQL, I don't think
I've ever seen them escaped.
....that's magic_quotes_runtime, which is OFF by default. These are
separate options.
IMO, it's bad practice to use/depend on magic_quotes being on.

<nod>

-- brion vibber (brion @ pobox.com)

[Joe Webster]

"Brion Vibber" <br***@pobox.com> wrote in message
news:39*************@individual.net...

"Ken in Melbourne Australia" <ke*@mira.net> wrote:

The PHP manual defines
"magic_quotes_runtime

If enabled, most functions that return data from an external
source, including databases and text files, will have quotes
escaped with a backslash "...

This term 'external source' isn't defined anywhere in the
manual! Is the data in our $_GET and $_POST variables
considered an external source? The term 'most functions'
without further explanation is most ambiguous.
Well, $_GET and $_POST are not functions. They are array variables.
If magic_quotes_gpc is set to off in the php.ini file, can
we control whether the $_GET and $_POST data is
automagically slashed using set_magic_quotes_runtime()?
or is magic_quotes_runtime only used for the data coming
out of our database or files and a few special uses?
You could test this question in much less time than it takes to ask a
question on usenet and wait for a response. :)

Because magic_quotes_runtime corrupts data with slashes coming from
various _unspecified_ functions, you should probably never, ever use
magic_quotes_runtime without doing a lot of careful testing.

For the array values, which are already present at the start of the
script, you must check whether magic_quotes_gpc is on and use
stripslashes() as appropriate to get the uncorrupted values of the
submitted data.

Always perform the appropriate escaping (eg with
mysql_real_escape_string()) before putting data into an SQL statement.

Joe Webster wrote:

If magic_quotes is turned on (the last time I actually used it) I'm

pretty sure a form that a GET/POST request will be escaped to ease insertion into a database for example.

That's magic_quotes_gpc, which is ON by default...

Coming out of a database such as mySQL, I don't think
I've ever seen them escaped.

...that's magic_quotes_runtime, which is OFF by default. These are
separate options.

IMO, it's bad practice to use/depend on magic_quotes being on.

<nod>

-- brion vibber (brion @ pobox.com)

You know, it's usually at the end of my day when I'm tired when I start
getting to the news group -- maybe I should keep my fingers shut :) Anyway,
Brion is right... two different options.

http://us4.php.net/magic_quotes

I feel sorry for whoever came up with magic_quotes*, realizing that we all
hate him for the confusion :)

-Joe