Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:50320
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain garfieldtech.com from 76.96.30.56 cause and error)
To: internals@lists.php.net
Date: Wed, 17 Nov 2010 23:40:37 -0600
User-Agent: KMail/1.13.5 (Linux/2.6.34.7-0.5-desktop; KDE/4.4.4; x86_64; ; )
References: <AANLkTin3-7w6wmFHvX+T+xoCF5HxSB=sSt4vYnkPW4y-@mail.gmail.com> <6628E909-5B8E-4FB4-A28F-ECAF7FCA27AB@roshambo.org>
In-Reply-To: <6628E909-5B8E-4FB4-A28F-ECAF7FCA27AB@roshambo.org>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <201011172340.37217.larry@garfieldtech.com>
Subject: Re: [PHP-DEV] Magic quotes in trunk
From: larry@garfieldtech.com (Larry Garfield)

On Wednesday, November 17, 2010 11:19:05 pm Philip Olson wrote:
> > What are your inputs on this matter?
> 
> I'm struggling with this topic. We must do something, but it's important to
> understand that plenty of people unknowingly rely upon this security
> feature that's still enabled by default. Granted 5.3 does generate
> E_DEPRECATED errors when magical quotes are enabled, but is one minor PHP
> version of errors enough to go from on to gone?
> 
> So while those in the know (e.g., people who follow this list) find them
> annoying and wish they never existed, what are the implications? I'm still
> unsure how best to handle this situation but wanted to express these
> feelings now. Whatever the case, the education effort towards data
> filtering and sanitization requires a lot of improvement.
> 
> Regards,
> Philip

I won't miss magic quotes if they're removed, but I can see the argument for 
saying "not quite yet".  Off-by-default is absolutely necessary if they're 
kept.  (Dear god, you mean they aren't off by default already?)

--Larry Garfield