Magic quotes in PHP

by

Magic quotes are inherently broken. They were meant to sanitize input to the PHP script, but without knowing how that input will be used it’s impossible to sanitize correctly. If anything, you’re better off checking if magic quotes are enabled, then calling stripslashes() on $_GET/$_POST/$_COOKIES/$_REQUEST, and then sanitizing your variables at the point where you’re using it somewhere. E.g. urlencode() if you’re using it in a URL, htmlentities() if you’re printing it back to a web page, or using your database driver’s escaping function if you’re storing it to a database. Note those input arrays could contain sub-arrays so you might need to write a function can recurse into the sub-arrays to strip those slashes too.

The PHP man page on magic quotes agrees:

“This feature has been DEPRECATED as
of PHP 5.3.0 and REMOVED as of PHP
5.4.0. Relying on this feature is highly discouraged. Magic Quotes is a
process that automagically escapes
incoming data to the PHP script. It’s
preferred to code with magic quotes
off and to instead escape the data at
runtime, as needed.”

More Related Contents:

  1. How can I secure my source code [closed]
  2. Are PDO prepared statements sufficient to prevent SQL injection?
  3. Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?
  4. Why would one omit the close tag?
  5. How to secure database passwords in PHP?
  6. Reference: What is a perfect code sample using the MySQL extension? [closed]
  7. The ultimate clean/secure function
  8. How to encrypt/decrypt data in php?
  9. Exploitable PHP functions
  10. Preventing Directory Traversal in PHP but allowing paths
  11. What is the best way to stop people hacking the PHP-based highscore table of a Flash game
  12. preventing csrf in php
  13. Generating cryptographically secure tokens
  14. Which $_SERVER variables are safe?
  15. How to best store user information and user login and password
  16. What do I need to store in the php session when user logged in?
  17. PHP setcookie “SameSite=Strict”?
  18. Many hash iterations: append salt every time?
  19. Is it ever ok to store password in plain text in a php variable or php constant?
  20. What security issues should I look out for in PHP
  21. How do you set up use HttpOnly cookies in PHP
  22. Is it secure to store a password in a session? [duplicate]
  23. What security problems could come from exposing phpinfo() to end users?
  24. Set httpOnly and secure on PHPSESSID cookie in PHP
  25. Does PHP’s $_REQUEST method have a security problem?
  26. is $_SERVER[‘HTTP_REFERER’] safe?
  27. Json: PHP to JavaScript safe or not?
  28. How can I disable PHP magic quotes at runtime?
  29. Limiting user login attempts in PHP [duplicate]
  30. What encryption algorithm is best for encrypting cookies?

Leave a Comment