Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:50301
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.177 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:date:x-google-sender-auth:message-id:subject
         :from:to:content-type;
        b=VuXguK7iV8UfLN7jHDJmclnBgUepE0s7Od8mKqK0R5zSZJj3Iyiao+kPJvR24x5sXf
         u1HOrLuCSFmGLXbT6Q3xtZLursPJobhPKIiXTP/fOYmDTMQmHME5RRQCnCUOKY1tKrhI
         +4ugYexsM/mAhOQ80cq58djkINypww/mw1fEE=
MIME-Version: 1.0
Sender: kalle.php@gmail.com
Date: Wed, 17 Nov 2010 17:08:36 +0100
Message-ID: <AANLkTin3-7w6wmFHvX+T+xoCF5HxSB=sSt4vYnkPW4y-@mail.gmail.com>
To: Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Magic quotes in trunk
From: kalle@php.net (Kalle Sommer Nielsen)

Greetings

I wanted to raise this topic before we go Alpha with trunk, regarding
our beloved magic_quotes feature. There seems to be mixed opinions
regarding it so I thought I would take it up for discussion.

We have advised people not to use magic_quotes, register_globals and
the like for years, and they were marked as deprecated in 5.3.0+ if
activated through their php.ini directives. Yet magic_quotes still is
set to "On" in 5.3.0. I think its worth we either remove the feature
or disable it in trunk as its a security related feature. Lets have a
look at what each of those options means:

Removing magic_quotes):
Means we will remove the feature entirely in the source, we will throw
an E_CORE_ERROR if activated so people who have it enabled are forced
to disable it and make their applications work without magic_quotes.
This creates a minor issue for the hosts that simply disable it and
have their customers applications run without them which can create a
security risk for them, although it should be fairly limited. The
functions to check for magic_quotes_runtime should however stay for BC
to avoid applications that run on multiple versions of PHP from doing:
if(function_exists('...') && ...)

Disabling them):
This will help to disable the spread of magic_quotes even more, and it
can safely be removed in the next major version of PHP.


My personal vote here goes towards removing them entirely.


What are your inputs on this matter?

-- 
regards,

Kalle Sommer Nielsen
kalle@php.net