import_request_variables isn't importing my changes to my globals

[Brian Kendig]

The server I'm running my PHP on has "magic_quotes" turned on, so all
the input I get (from GET, POST, and cookies) is escaped with
backslashes. I don't want this (I handle my own escaping, and I need to
be able to work with unescaped strings), but I'm not allowed to change
the setting on the server, so I need to figure out a way to "undo"
magic quotes.

This code itself works...

function stripslashes_array($v) {
return is_array($v) ? array_map('stripslashes_array', $v) :
stripslashes($v);
}
if (get_magic_quotes_gpc()) {
foreach (array('POST', 'GET', 'REQUEST', 'COOKIE') as $gpc)
$GLOBALS["_$gpc"] = array_map('stripslashes_array',
$GLOBALS["_$gpc"]);
}

But my problem is that I then want to use import_request_variables to
bring any form data into the global variable space, and that's not
reflecting the changes I just made to the globals... in other words, if
after that code I say:

$foo = "GLOBALS["_GET"]["test"];
import_request_variables("gp", "in_");
$bar = $in_test;

and I submit the page with "test" set to a'b'c, then $foo will be a'b'c
while $bar will be a\'b\'c.

How do I get the stripslashed values into my global variables without
having to stripslash each one individually?

[musicinmyhead]

The only way I know of that you *might* be able to turn off the
magic_quotes_gpc option (temporarily) would be to use the ini_set()
function. Or are you not allowed to use ini_set()? I'll just hope not.

If you can use it, at the start of the script simply put
ini_set('magic_quotes_gpc', '0')
and that should turn off magic_quotes for the purpose of processing
that page.

Hopefully that will work, if not then it seems like you'll have to do
it all the tedious way and stripslash each one.

[Brian Kendig]

ini_set doesn't work with magic_quotes, because by the time PHP starts
executing my script and sees that ini_set statement, it's already done
magic quotes on the input.

It's looking like this might be a bug in import_request_variables,
where it gets its data from some place other than $_GET and $_POST and
$_COOKIE.