Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:50403
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.170 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type:content-transfer-encoding;
        b=XZ0CTrXUgJa54eJc64f5oP9cSrUgCzKVZ3SQaETU0FoOhX9TA8EX32KjBrevXGQSHQ
         h+01GHNpm2xumbo34XHDaTWzmvac66Vn3OXQ/b7yJrA6iCxvZkFZ7t0BVu7wy8MIU8cZ
         BgJm83Oj35ifT3E2mMHgvhk2cE9Fy0Cnejiqc=
MIME-Version: 1.0
In-Reply-To: <E410B8BD-E5EC-478F-B6FB-82ACAFBA080A@roshambo.org>
References: <AANLkTin3-7w6wmFHvX+T+xoCF5HxSB=sSt4vYnkPW4y-@mail.gmail.com>
	<6628E909-5B8E-4FB4-A28F-ECAF7FCA27AB@roshambo.org>
	<201011172340.37217.larry@garfieldtech.com>
	<20101118162047.GA26431@panix.com>
	<1290097549.16819.180.camel@guybrush>
	<20101119151702.GA5937@panix.com>
	<AANLkTik6tg+FEf1Dm3Qb1HeL7_1D-Gv=WEaq8OdA2uTF@mail.gmail.com>
	<20101119161415.GA21178@panix.com>
	<AANLkTim8uQ_0WV8GmXMiEX367zL5t4rWsHK23b2SXGsg@mail.gmail.com>
	<E410B8BD-E5EC-478F-B6FB-82ACAFBA080A@roshambo.org>
Date: Sat, 20 Nov 2010 10:51:31 -0800
Message-ID: <AANLkTinS+z0U-Xa0zKKFNiV5WfwCvorH2P0JvDhH=CbO@mail.gmail.com>
To: Philip Olson <philip@roshambo.org>
Cc: Daniel Convissor <danielc@analysisandsolutions.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Magic quotes in trunk
From: ssufficool@gmail.com (Stanley Sufficool)

On Fri, Nov 19, 2010 at 10:36 PM, Philip Olson <philip@roshambo.org> wrote:
>
> On Nov 19, 2010, at 6:45 PM, Stanley Sufficool wrote:
>> On Fri, Nov 19, 2010 at 8:14 AM, Daniel Convissor
>> <danielc@analysisandsolutions.com> wrote:
>>> On Fri, Nov 19, 2010 at 04:41:48PM +0100, Ferenc Kovacs wrote:
>>>> you can get pwn3d with magic_quotes_gpc =3D On
>>>
>>> That goes without saying. =A0None the less, it will be problematic for =
PHP
>>> to disable/remove a "security" feature that some people rely on.
>>
>> Well then +1 for making the setting throw depreciated PHP startup
>> notifications when turned on with a link to suggested security
>> practices for SQL, exec(), passthru(), and other sensitive functions
>> benefiting from magic quotes.
>
> Linking to a document sounds reasonable, but we already provide an E_DEPR=
ECATED error when any magic quotes setting is enabled (as of 5.3.0), so the=
 probable question here is if we should disable MQ by default (in 5.4) and =
remove it later (5.5 or 6.0), or simply remove it now. I lean towards disab=
ling by default in 5.4, and removing in 6.0.
>
>> Also throw an E_NOTICE depreciated for the magic_quotes_gpc() function
>> as well for those that check if this setting is on/off.
>
> Punishing people who write compatible code feels wrong, so get_magic_quot=
es_gpc() should never emit an error. Heck, this harmless function might eve=
n exist in PHP 7. My guess is most people simply run stripslashes() if On, =
rather than avoid superior escaping mechanisms.

I retract my assertion that  get_magic_quotes_gpc() throw anything. ;-)

>
>> But please start the movement in the direction that this will be
>> removed in the future.
>
> I\'m having a difficult time grasping the exact implications here, except=
 that a default value change mostly affects people without php.ini files. I=
\'m not sure who those people are, or how they may end up using PHP 5.4, bu=
t maybe a wiser old timer can predict this story. But for good measure:
>
> What we have already done with magic_quotes_gpc:
> -------
> (Note: sister magic_quotes_runtime has always defaulted to Off)
>
> PHP 4, 5.0, 5.1, 5.2
> - Default (On)
> - php.ini-dist (On)
> - php.ini-recommended (Off)
>
> PHP 5.3
> - Default (On)
> - php.ini-development (Off)
> - php.ini-production (Off)
> - E_DEPRECATED error when On
>
> Distributions/vendors:
> - I\'m not sure which defaults they all use
>
> We\'ve recommended Off for a long time now (year ~2000) so should feel ok=
ay with whatever decision is made. But, our main focus is handling clueless=
 code that magically works (sort of) thanks to magical quotes. Magic!

FWIW, My SQL Server code doesn't magically work with this setting on,
I just get a bunch of crappy "quote\\\\\\\\\\\'s " values after
several iterations.

>
> Regards,
> Philip
>
>