Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:42158
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 192.18.6.21 as permitted sender)
Date: Mon, 08 Dec 2008 17:19:52 +0100
In-reply-to: <10845a340812080803u2a1ef114j7dae338186725ba5@mail.gmail.com>
Sender: Johannes.Schlueter@Sun.COM
To: RQuadling@GoogleMail.com
Cc: PHP Internals List <internals@lists.php.net>
Message-ID: <1228753192.3429.30.camel@goldfinger.johannes.nop>
MIME-version: 1.0
Content-type: text/plain
Content-transfer-encoding: 7BIT
References: <1228751251.3429.18.camel@goldfinger.johannes.nop>
 <10845a340812080803u2a1ef114j7dae338186725ba5@mail.gmail.com>
Subject: Re: [PHP-DEV] About dropping magic_quotes in 5.3 (was: Re:	[PHP-DEV]
 Re: PHP 5.2.7 + magic_quotes_gpc broken)
From: johannes@php.net (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

Hi,

On Mon, 2008-12-08 at 16:03 +0000, Richard Quadling wrote:
> But I also understand it is pretty shitty to miss a 1 liner (magic
> quotes removed) and find everything broken and then to be told
> RTFM/RTFCL.

There's a difference between this and other breaks: Most other BC breaks
change the behavior in a way you can easily spot, the magic_quotes issue
will only be spotted when actually testing for it - using the PHP app as
it is supposed will work like a charm. Only when adding " or ' you get
an SQL error ... which is a big security issue. (which again is
different from other BC breaks which just result in not working code)

I don't safe stuff relying on magic_quotes is safe but kicking it will
open up way more attack vectors... :-(

johannes