Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:50304
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 85.25.71.29 as permitted sender)
To: "'Internals'" <internals@lists.php.net>
References: <AANLkTin3-7w6wmFHvX+T+xoCF5HxSB=sSt4vYnkPW4y-@mail.gmail.com>
In-Reply-To: <AANLkTin3-7w6wmFHvX+T+xoCF5HxSB=sSt4vYnkPW4y-@mail.gmail.com>
Date: Wed, 17 Nov 2010 17:28:07 +0100
Message-ID: <002d01cb8674$6b13a910$413afb30$@php.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AQIQs10NH5H57cEEdOY7iMva4RlvoZLrggzw
Content-Language: de
Subject: RE: [PHP-DEV] Magic quotes in trunk
From: thetaphi@php.net ("Uwe Schindler")

Yeah,

+1 for remove!

-----
Uwe Schindler
thetaphi@php.net - http://www.php.net
NSAPI SAPI developer
Bremen, Germany


> -----Original Message-----
> From: kalle.php@gmail.com [mailto:kalle.php@gmail.com] On Behalf Of Kalle
> Sommer Nielsen
> Sent: Wednesday, November 17, 2010 5:09 PM
> To: Internals
> Subject: [PHP-DEV] Magic quotes in trunk
> 
> Greetings
> 
> I wanted to raise this topic before we go Alpha with trunk, regarding our
> beloved magic_quotes feature. There seems to be mixed opinions regarding
it
> so I thought I would take it up for discussion.
> 
> We have advised people not to use magic_quotes, register_globals and the
like
> for years, and they were marked as deprecated in 5.3.0+ if activated
through
> their php.ini directives. Yet magic_quotes still is set to "On" in 5.3.0.
I think its
> worth we either remove the feature or disable it in trunk as its a
security
> related feature. Lets have a look at what each of those options means:
> 
> Removing magic_quotes):
> Means we will remove the feature entirely in the source, we will throw an
> E_CORE_ERROR if activated so people who have it enabled are forced to
> disable it and make their applications work without magic_quotes.
> This creates a minor issue for the hosts that simply disable it and have
their
> customers applications run without them which can create a security risk
for
> them, although it should be fairly limited. The functions to check for
> magic_quotes_runtime should however stay for BC to avoid applications that
> run on multiple versions of PHP from doing:
> if(function_exists('...') && ...)
> 
> Disabling them):
> This will help to disable the spread of magic_quotes even more, and it can
> safely be removed in the next major version of PHP.
> 
> 
> My personal vote here goes towards removing them entirely.
> 
> 
> What are your inputs on this matter?
> 
> --
> regards,
> 
> Kalle Sommer Nielsen
> kalle@php.net
> 
> --
> PHP Internals - PHP Runtime Development Mailing List To unsubscribe,
visit:
> http://www.php.net/unsub.php