# About dropping magic_quotes in 5.3 (was: Re: Re: PHP 5.2.7 + magic_quotes_gpc broken) - Thread: https://externals.io/message/42150 - Original archive: https://news-web.php.net/php.internals/42150 - Started by johannes@php.net on 2008-12-08T15:47:31+00:00 - Messages: 31 - Page 1 of 2: messages 1 to 25 (25 per page, add `?page=N` to the URL) - Next page: https://externals.io/message/42150.md?page=2 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #42150 — johannes@php.net — 2008-12-08T15:47:31+00:00 URL: https://externals.io/message/42150#42150 Hi, let's take this to a new thread so it'S not hidden in other discussions: > > […] > > Time to turn it off by default then? Getting rid of magic_quotes would be really nice but has a very big "BUT". Many things (I won't call it "applications" or something...) out there are accidentially more or less safe due to magic_quotes. Many of these things were written by people with, at most, basic understanding of the what they are doing and now are running at some random hosting company on a $9.99/year (no idea what today's prices are) When dropping magic_quotes the hosting company can do one of two things: a) not update to 5.3 so we either have to maintain 5.2 for some time or let them have problems b) update to 5.3. Doing that means they break many of there customer's code. Now they could add a default filter to add quotes again, what's the win? Except that it will break magic_quotes-compatible code and makes it harder to detect? People won't fix the code - the code was "developed" by some web design company 5 years ago and nobody touches the site anymore and there's no maintenance contract between the design company and the site owner anymore... The only way I see for getting rid of magic_quotes is with a version which will require people to touch the code anyways and with a big "marketing campaign" so I think PHP 6 is a way better time for that even so I'm really annoyed by it when doing stuff myself... Comments and other views are welcome, johannes --- ## #42153 — Hannes Magnusson — 2008-12-08T15:53:41+00:00 URL: https://externals.io/message/42150#42153 · In reply to: #42150 > Hi, > > let's take this to a new thread so it'S not hidden in other discussions: > > > > […] > > Getting rid of magic_quotes would be really nice but has a very big > "BUT". Of course we can't remove it. But I however find it very interesting that MQ_gpc is _enabled by default_. -Hannes --- ## #42154 — Pierre Joye — 2008-12-08T15:57:17+00:00 URL: https://externals.io/message/42150#42154 · In reply to: #42150 > Hi, > > let's take this to a new thread so it'S not hidden in other discussions: > > > > […] > > Getting rid of magic_quotes would be really nice but has a very big > "BUT". > > Many things (I won't call it "applications" or something...) out there > are accidentially more or less safe due to magic_quotes. Many of these > things were written by people with, at most, basic understanding of the > what they are doing and now are running at some random hosting company > on a $9.99/year (no idea what today's prices are) > > When dropping magic_quotes the hosting company can do one of two things: > > a) not update to 5.3 so we either have to maintain 5.2 for some time or > let them have problems +1 I already discussed the possibility to maintain the 5.2 branch after 5.3-final (irc and some meetings) and I like to do it (in any case). I do think it is something to do but only for critical bug fixes (security or crash only). We may say that it is the job of the distributors, but I'd to disagree. It is critical for us to provide sources and binary releases of a stable branch officially, even after a newer branch has been released. Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42155 — Richard Quadling — 2008-12-08T16:03:32+00:00 URL: https://externals.io/message/42150#42155 · In reply to: #42150 2008/12/8 Johannes Schlüter : > Hi, > > let's take this to a new thread so it'S not hidden in other discussions: > > > > […] > > Getting rid of magic_quotes would be really nice but has a very big > "BUT". > > Many things (I won't call it "applications" or something...) out there > are accidentially more or less safe due to magic_quotes. Many of these > things were written by people with, at most, basic understanding of the > what they are doing and now are running at some random hosting company > on a $9.99/year (no idea what today's prices are) > > When dropping magic_quotes the hosting company can do one of two things: > > a) not update to 5.3 so we either have to maintain 5.2 for some time or > let them have problems > > b) update to 5.3. Doing that means they break many of there customer's > code. Now they could add a default filter to add quotes again, what's > the win? Except that it will break magic_quotes-compatible code and > makes it harder to detect? > > People won't fix the code - the code was "developed" by some web design > company 5 years ago and nobody touches the site anymore and there's no > maintenance contract between the design company and the site owner > anymore... > > The only way I see for getting rid of magic_quotes is with a version > which will require people to touch the code anyways and with a big > "marketing campaign" so I think PHP 6 is a way better time for that even > so I'm really annoyed by it when doing stuff myself... > > Comments and other views are welcome, > johannes I had a whole diatribe about past experience with upgrading accounting and EPOS systems pre Y2K. I deleted it. In short those that paid attention didn't have a problem. Those that know about it will be dealing with it or have already dealt with it. Those that don't know about it, won't know about it in V5.3, V6.0, V7.0, 8,9,10, enterprise, free-to-all, any-version-number-or-name-which-makes-you-stand-up-and-look. I hope that the majority are in the first group. As I understand it, you developers do NOT have a duty of care to stop us upgrading without first reading the changelogs. But I also understand it is pretty shitty to miss a 1 liner (magic quotes removed) and find everything broken and then to be told RTFM/RTFCL. If this is in V6, then it I would have though that this would be better received than in V5 release. Richard. -- ----- Richard Quadling Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731 "Standing on the shoulders of some very clever giants!" --- ## #42157 — Hannes Magnusson — 2008-12-08T16:18:41+00:00 URL: https://externals.io/message/42150#42157 · In reply to: #42154 > > > […] > > +1 We cannot simply nuke a feature that was once upon a time sold as a security feature, and is still enabled by default, just "out of the blue". > I already discussed the possibility to maintain the 5.2 branch after > 5.3-final (irc and some meetings) and I like to do it (in any case). I > do think it is something to do but only for critical bug fixes > (security or crash only). Of course should we continue to do security releases for "previous minor releases" until the "new one" is up to .2 or .3 at least. > We may say that it is the job of the distributors, but I'd to > disagree. It is critical for us to provide sources and binary releases > of a stable branch officially, even after a newer branch has been > released. How are distributions supposed to keep up to date with security fixes anyway? The only distro that has a chance is RHEL because they have an "inside guy". We really need to work on our relationship with other distros, starting with marking security fixes as security fixes. -Hannes --- ## #42158 — johannes@php.net — 2008-12-08T16:19:52+00:00 URL: https://externals.io/message/42150#42158 · In reply to: #42155 Hi, > But I also understand it is pretty shitty to miss a 1 liner (magic > quotes removed) and find everything broken and then to be told > RTFM/RTFCL. There's a difference between this and other breaks: Most other BC breaks change the behavior in a way you can easily spot, the magic_quotes issue will only be spotted when actually testing for it - using the PHP app as it is supposed will work like a charm. Only when adding " or ' you get an SQL error ... which is a big security issue. (which again is different from other BC breaks which just result in not working code) I don't safe stuff relying on magic_quotes is safe but kicking it will open up way more attack vectors... :-( johannes --- ## #42162 — Sean Coates — 2008-12-08T16:31:24+00:00 URL: https://externals.io/message/42150#42162 · In reply to: #42158 > I don't safe stuff relying on magic_quotes is safe but kicking it will > open up way more attack vectors... :-( In my opinion, this isn't about opening attack vectors (one hole is all it takes, so they're probably already vulnerable), but removing mqgpc without fair warning to end users could open up plenty of failure situations when the data is "trusted" and the developers didn't strip/escape the [magic] quotes properly: $_GET['search'] = "O'Reilly"; $sql = "select * from books where publisher = '" . $_GET['search'] ."'"; The above was never "safe", but it "worked" in a trusted environment with mqgpc on. Removing it would cause a SQL error. Note: I'm not condoning the use of mqgpc; just saying that disabling it abruptly has potential for a lot of unintended breakage. S --- ## #42163 — Philip Olson — 2008-12-08T16:35:35+00:00 URL: https://externals.io/message/42150#42163 · In reply to: #42157 > On Mon, Dec 8, 2008 at 16:57, Pierre Joye > wrote: > > […] > > We cannot simply nuke a feature that was once upon a time sold as a > security feature, and is still enabled by default, just "out of the > blue". Agreed, going from on by default to removed just feels odd. Regards, Philip --- ## #42165 — crrodriguez@suse.de — 2008-12-08T16:48:44+00:00 URL: https://externals.io/message/42150#42165 · In reply to: #42158 Johannes Schlüter escribió: > I don't safe stuff relying on magic_quotes is safe but kicking it will > open up way more attack vectors... :-( A false sense of security is worst than no security at all. -- "We have art in order not to die of the truth" - Friedrich Nietzsche Cristian Rodríguez R. Platform/OpenSUSE - Core Services SUSE LINUX Products GmbH Research & Development http://www.opensuse.org/ --- ## #42166 — Scott MacVicar — 2008-12-08T16:53:20+00:00 URL: https://externals.io/message/42150#42166 · In reply to: #42163 > > > > > […] > > Agreed, going from on by default to removed just feels odd. I'd disable it by default in 5.3 and lets start throwing a strict error if the configuration enables it. Scott --- ## #42168 — Scott MacVicar — 2008-12-08T17:10:19+00:00 URL: https://externals.io/message/42150#42168 · In reply to: #42167 Steph Fox wrote: > Hi Scott, > > > […] > > > […] > > Why do we have `E_DEPRECATED` if we're not going to use it? That's the one I meant, no idea why I thought strict. Scott --- ## #42167 — Steph Fox — 2008-12-08T17:11:43+00:00 URL: https://externals.io/message/42150#42167 · In reply to: #42166 Hi Scott, > > […] > I'd disable it by default in 5.3 and lets start throwing a strict > error if the configuration enables it. Why do we have `E_DEPRECATED` if we're not going to use it? - Steph --- ## #42171 — Pierre Joye — 2008-12-08T17:34:20+00:00 URL: https://externals.io/message/42150#42171 · In reply to: #42166 hi, > I'd disable it by default in 5.3 and lets start throwing a strict error if > the configuration enables it. A fatal error could be more effective. And the message can make the reason behind the error very clear. By the way and for the record here, they (magic quotes, register global and safe mode) are already removed in php6. Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42172 — Scott MacVicar — 2008-12-08T17:37:52+00:00 URL: https://externals.io/message/42150#42172 · In reply to: #42171 Pierre Joye wrote: > hi, > > > > > […] > > A fatal error could be more effective. And the message can make the > reason behind the error very clear. If it's gone in php6 then imho it should be throwing a deprecated error already. > > By the way and for the record here, they (magic quotes, register > global and safe mode) are already removed in php6. > > Cheers, Scott --- ## #42173 — Steph Fox — 2008-12-08T18:08:57+00:00 URL: https://externals.io/message/42150#42173 · In reply to: #42171 Hi Pierre, > A fatal error could be more effective. And the message can make the > reason behind the error very clear. It's a very big jump from 'enabled by default' to 'fatal error'. It will break a lot of legacy code with no prior warning. > By the way and for the record here, they (magic quotes, register > global and safe mode) are already removed in php6. All the more reason to disable them all by default and have them throw `E_DEPRECATED` in 5.3. - Steph > > Cheers, > -- > Pierre > > http://blog.thepimp.net | http://www.libgd.org --- ## #42174 — Ilia Alshanetsky — 2008-12-08T19:11:03+00:00 URL: https://externals.io/message/42150#42174 · In reply to: #42150 In my opinion a big change like droping something that was and still used by many people are a "security measure", albeit a poor one is something that can only be done in a major release. > Hi, > > let's take this to a new thread so it'S not hidden in other > discussions: > > > > […] > > Getting rid of magic_quotes would be really nice but has a very big > "BUT". > > Many things (I won't call it "applications" or something...) out there > are accidentially more or less safe due to magic_quotes. Many of these > things were written by people with, at most, basic understanding of > the > what they are doing and now are running at some random hosting company > on a $9.99/year (no idea what today's prices are) > > When dropping magic_quotes the hosting company can do one of two > things: > > a) not update to 5.3 so we either have to maintain 5.2 for some time > or > let them have problems > > b) update to 5.3. Doing that means they break many of there customer's > code. Now they could add a default filter to add quotes again, what's > the win? Except that it will break magic_quotes-compatible code and > makes it harder to detect? > > People won't fix the code - the code was "developed" by some web > design > company 5 years ago and nobody touches the site anymore and there's no > maintenance contract between the design company and the site owner > anymore... > > The only way I see for getting rid of magic_quotes is with a version > which will require people to touch the code anyways and with a big > "marketing campaign" so I think PHP 6 is a way better time for that > even > so I'm really annoyed by it when doing stuff myself... > > Comments and other views are welcome, > johannes > > > -- > > > Ilia Alshanetsky --- ## #42175 — Derick Rethans — 2008-12-08T19:15:09+00:00 URL: https://externals.io/message/42150#42175 · In reply to: #42174 > In my opinion a big change like droping something that was and still used by > many people are a "security measure", albeit a poor one is something that can > only be done in a major release. I concur. regards, Derick -- HEAD before 5_3!: http://tinyurl.com/6d2esb http://derickrethans.nl | http://ezcomponents.org | http://xdebug.org --- ## #42176 — Hannes Magnusson — 2008-12-08T19:38:07+00:00 URL: https://externals.io/message/42150#42176 · In reply to: #42175 > > > > […] > > I concur. Like I said, we simply cannot nuke it. But we can however turn it off by default. -Hannes --- ## #42177 — Pierre Joye — 2008-12-08T19:43:10+00:00 URL: https://externals.io/message/42150#42177 · In reply to: #42176 > > > […] > > Like I said, we simply cannot nuke it. But we can however turn it off > by default. and add a deprecation notice. Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42178 — Ilia Alshanetsky — 2008-12-08T19:43:47+00:00 URL: https://externals.io/message/42150#42178 · In reply to: #42176 As much as I hate the feature, I am not certain that is a good idea in a minor release. > > > […] > > Like I said, we simply cannot nuke it. But we can however turn it off > by default. > > -Hannes Ilia Alshanetsky --- ## #42179 — Steph Fox — 2008-12-08T20:12:22+00:00 URL: https://externals.io/message/42150#42179 · In reply to: #42178 > As much as I hate the feature, I am not certain that is a good idea in > a minor release. "If not now, when?" - Steph --- ## #42180 — Ilia Alshanetsky — 2008-12-08T20:48:04+00:00 URL: https://externals.io/message/42150#42180 · In reply to: #42179 6.0 iirc its already off by default in that branch. > > […] > > "If not now, when?" > > - Steph Ilia Alshanetsky --- ## #42181 — Pierre Joye — 2008-12-08T20:50:58+00:00 URL: https://externals.io/message/42150#42181 · In reply to: #42180 hi, > 6.0 iirc its already off by default in that branch. It is not off by default, it has been removed completely. I re introduced the check function (returning always false) later. Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42182 — Steph Fox — 2008-12-08T20:55:11+00:00 URL: https://externals.io/message/42150#42182 · In reply to: #42180 > 6.0 iirc its already off by default in that branch. Ilia, it doesn't *exist* in that branch! - Steph --- ## #42184 — Ilia Alshanetsky — 2008-12-08T21:19:32+00:00 URL: https://externals.io/message/42150#42184 How would that model relate to patch, minor, major release schemes we have right now. What you are proposing works for linux, where there is only one "branch" and they can effectively do the odd/even approach. But, what would it mean for PHP and our current versioning schema? > Hello Ilia, > > given our current development model I completely agree. Thus I > would like > to change it as described earlier. I am convinced that only > following the > even=stable & odd=dev/testing model allows for longer maintenanance > cycles > and fast development at the same time. > > marcus > > Monday, December 8, 2008, 8:11:03 PM, you wrote: > > > > […] > > > […] > > > […] > > > […] > > > > > > > > > Best regards, > Marcus > Ilia Alshanetsky --- Next page: https://externals.io/message/42150.md?page=2