# magic_quotes_gpc behaviour

- Thread: https://externals.io/message/28706
- Original archive: https://news-web.php.net/php.internals/28706
- Started by Arpad Ray on 2007-04-07T14:19:24+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #28706 — Arpad Ray — 2007-04-07T14:19:24+00:00

URL: https://externals.io/message/28706#28706

Hi all,

I'm curious about something with magic_quotes_gpc - it ignores the keys 
of array values in $_GET etc, despite escaping keys of scalar values and 
all keys in contained arrays. For example, the query string ?a'b=1 
yields $_GET[a\'b] = 1, but ?a'b[a'b]=1 yields $_GET[a'b][a\'b] = 1.

While many other aspects of magic_quotes_gpc have changed, this 
behaviour seems to have stayed the same since at least PHP 4.2.0, see:
http://www.rajeczy.com/compat_gpc_tests.txt

So, is this behaviour deliberate, and if so, what's the rationale?

Arpad

---

## #28722 — Arpad Ray — 2007-04-09T13:41:12+00:00

URL: https://externals.io/message/28706#28722 · In reply to: #28706

Arpad Ray wrote:
> So, is this behaviour deliberate, and if so, what's the rationale?
>

The problem seems to be in (5.2.x CVS) php_variables.c, lines 161-166:

                if (PG(magic_quotes_gpc) && (index != var)) {
                    /* no need to `addslashes()` the index if it's the 
main variable name */
                    escaped_index = php_addslashes(index, index_len, 
&index_len, 0 TSRMLS_CC);
                } else {
                    escaped_index = index;
                }

If "&& (index != var)" is removed, all keys are escaped as expected. The 
equivalent line for keys of scalar variables (198) lacks this check 
since 5.0.0, and since then it has escaped them correctly. It's still 
there in the 4.4 branch.

Is there any reason not to remove this check, at least in the 5.2 branch?

Arpad

---

## #28723 — dz@bitxtender.com — 2007-04-10T07:28:14+00:00

URL: https://externals.io/message/28706#28723 · In reply to: #28706

Am 09.04.2007 um 15:41 schrieb Arpad Ray:
> Arpad Ray wrote:
> > […]
>
> The problem seems to be in (5.2.x CVS) php_variables.c, lines 161-166:
>
>                if (PG(magic_quotes_gpc) && (index != var)) {
>                    /* no need to `addslashes()` the index if it's the  
> main variable name */
>                    escaped_index = php_addslashes(index, index_len,  
> &index_len, 0 TSRMLS_CC);
>                } else {
>                    escaped_index = index;
>                }
>
> If "&& (index != var)" is removed, all keys are escaped as  
> expected. The equivalent line for keys of scalar variables (198)  
> lacks this check since 5.0.0, and since then it has escaped them  
> correctly. It's still there in the 4.4 branch.
>
> Is there any reason not to remove this check, at least in the 5.2  
> branch?

Yes, BC. magic_quotes is crappy/complicated enough to deal with  
already, please don't make it behave differently between PHP5  
versions. No need to. Nobody should use it anymore, so there is no  
reason to change behavior again anyway.


David

---

## #28916 — Arpad Ray — 2007-04-18T09:59:32+00:00

URL: https://externals.io/message/28706#28916

Update: I raised this issue as a bug (#41093) because of lack of 
interest here. It's now been fixed in CVS and will therefore be in 5.2.2 
RC2 (thanks Ilia).

Arpad