Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:42162
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain caedmon.net from 64.15.79.181 cause and error)
Cc: RQuadling@GoogleMail.com,
 PHP Internals List <internals@lists.php.net>
Message-ID: <89A3B2FC-7885-4249-836F-D5671B22DF46@caedmon.net>
To: =?ISO-8859-1?Q?Johannes_Schl=FCter?= <johannes@php.net>
In-Reply-To: <1228753192.3429.30.camel@goldfinger.johannes.nop>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v929.2)
Date: Mon, 8 Dec 2008 11:31:24 -0500
References: <1228751251.3429.18.camel@goldfinger.johannes.nop> <10845a340812080803u2a1ef114j7dae338186725ba5@mail.gmail.com> <1228753192.3429.30.camel@goldfinger.johannes.nop>
Subject: Re: [PHP-DEV] About dropping magic_quotes in 5.3 (was: Re:	[PHP-DEV] Re: PHP 5.2.7 + magic_quotes_gpc broken)
From: sean@caedmon.net (Sean Coates)

> I don't safe stuff relying on magic_quotes is safe but kicking it will
> open up way more attack vectors... :-(

In my opinion, this isn't about opening attack vectors (one hole is  
all it takes, so they're probably already vulnerable), but removing  
mqgpc without fair warning to end users could open up plenty of  
failure situations when the data is "trusted" and the developers  
didn't strip/escape the [magic] quotes properly:

$_GET['search'] = "O'Reilly";

$sql = "select * from books where publisher = '" . $_GET['search'] ."'";

The above was never "safe", but it "worked" in a trusted environment  
with mqgpc on. Removing it would cause a SQL error.

Note: I'm not condoning the use of mqgpc; just saying that disabling  
it abruptly has potential for a lot of unintended breakage.

S