Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:42150
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 192.18.6.24 as permitted sender)
Date: Mon, 08 Dec 2008 16:47:31 +0100
Sender: Johannes.Schlueter@Sun.COM
To: PHP Internals List <internals@lists.php.net>
Cc: Hannes Magnusson <bjori@php.net>
Message-ID: <1228751251.3429.18.camel@goldfinger.johannes.nop>
MIME-version: 1.0
Content-type: text/plain
Content-transfer-encoding: 7BIT
Subject: About dropping magic_quotes in 5.3 (was: Re: [PHP-DEV] Re: PHP	5.2.7 +
 magic_quotes_gpc broken)
From: johannes@php.net (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

Hi,

let's take this to a new thread so it'S not hidden in other discussions:

On Mon, 2008-12-08 at 16:06 +0100, Hannes Magnusson wrote:
> > I do not think it is necessary for 5.3. It is an alpha release after
> > all and seriously, anyone who plans to move to 5.3.0 and still
> > relies on magic quotes gpc is likely to have more issues as well.
> 
> Time to turn it off by default then?

Getting rid of magic_quotes would be really nice but has a very big
"BUT".

Many things (I won't call it "applications" or something...) out there
are accidentially more or less safe due to magic_quotes. Many of these
things were written by people with, at most, basic understanding of the
what they are doing and now are running at some random hosting company
on a $9.99/year (no idea what today's prices are)

When dropping magic_quotes the hosting company can do one of two things:

a) not update to 5.3 so we either have to maintain 5.2 for some time or
let them have problems

b) update to 5.3. Doing that means they break many of there customer's
code. Now they could add a default filter to add quotes again, what's
the win? Except that it will break magic_quotes-compatible code and
makes it harder to detect?

People won't fix the code - the code was "developed" by some web design
company 5 years ago and nobody touches the site anymore and there's no
maintenance contract between the design company and the site owner
anymore...

The only way I see for getting rid of magic_quotes is with a version
which will require people to touch the code anyways and with a big
"marketing campaign" so I think PHP 6 is a way better time for that even
so I'm really annoyed by it when doing stuff myself...

Comments and other views are welcome,
johannes