set_magic_quotes_runtime is still E_DEPRECATED

16 years ago by Greg Beaver — view source — reply

unread

Hi,

in PHP_5_3 if you're using set_magic_quotes_runtime(0), it raises an
E_DEPRECATED. I thought all that argument was resolved to only throw
E_DEPRECATED for set_magic_quotes_runtime(1)?

This is a major pain if magic_quotes are enabled and you need to turn
them off to do unserialize or serialize to a file.

Greg

16 years ago by Lukas Kahwe Smith — view source — reply

unread

Hi,

in PHP_5_3 if you're using set_magic_quotes_runtime(0), it raises an
E_DEPRECATED. I thought all that argument was resolved to only throw
E_DEPRECATED for set_magic_quotes_runtime(1)?

This is a major pain if magic_quotes are enabled and you need to turn
them off to do unserialize or serialize to a file.

The purpose of E_DEPRECATED is to alert of changes in up coming major
PHP versions.

So if the function is removed entirely from PHP6, then the way things
are is correct. If the function still exists, but simply doesn't do
anything (or even raises an error) when "set_magic_quotes_runtime(1)"
is called, but silently continues when "set_magic_quotes_runtime(0)"
is called, then it should be changed as per Greg's request.

regards,
Lukas Kahwe Smith
mls@pooteeweet.org

16 years ago by Pierre Joye — view source — reply

unread

hi,

Hi,

in PHP_5_3 if you're using set_magic_quotes_runtime(0), it raises an
E_DEPRECATED. I thought all that argument was resolved to only throw
E_DEPRECATED for set_magic_quotes_runtime(1)?

This is a major pain if magic_quotes are enabled and you need to turn
them off to do unserialize or serialize to a file.

The purpose of E_DEPRECATED is to alert of changes in up coming major PHP
versions.

So if the function is removed entirely from PHP6, then the way things are is
correct. If the function still exists, but simply doesn't do anything (or
even raises an error) when "set_magic_quotes_runtime(1)" is called, but
silently continues when "set_magic_quotes_runtime(0)" is called, then it
should be changed as per Greg's request.

The set_magic_quotes_runtime is removed in php6, not the getter. The
getter always returns FALSE without any notice or warning.

I think it makes sense to keep the deprecate warning for the setter.

Cheers,

Pierre

http://blog.thepimp.net | http://www.libgd.org

16 years ago by Hannes Magnusson — view source — reply

unread

hi,

Hi,

in PHP_5_3 if you're using set_magic_quotes_runtime(0), it raises an
E_DEPRECATED. I thought all that argument was resolved to only throw
E_DEPRECATED for set_magic_quotes_runtime(1)?

This is a major pain if magic_quotes are enabled and you need to turn
them off to do unserialize or serialize to a file.

I think it makes sense to keep the deprecate warning for the setter.

Even to disable MQ runtime?
I don't know.. Since MQ is deprecated why are we throwing warnings
when people are trying to turn it off?

-Hannes

16 years ago by Hannes Magnusson — view source — reply

unread

Hannes Magnusson a écrit :

hi,

On Tue, Jun 16, 2009 at 9:46 AM, Lukas Kahwe Smithmls@pooteeweet.org
wrote:

Hi,

in PHP_5_3 if you're using set_magic_quotes_runtime(0), it raises an
E_DEPRECATED. I thought all that argument was resolved to only throw
E_DEPRECATED for set_magic_quotes_runtime(1)?

This is a major pain if magic_quotes are enabled and you need to turn
them off to do unserialize or serialize to a file.

I think it makes sense to keep the deprecate warning for the setter.

Even to disable MQ runtime?
I don't know.. Since MQ is deprecated why are we throwing warnings
when people are trying to turn it off?

-Hannes

Because in PHP 6 (or next) the function "set_magic_quotes_runtime()" will be
removed, so calling it without checking ini_get() will trigger a fatal
error, no ?

And there is the problem.
The recommended way is:
if(get_magic_quotes_runtime()) {
set_magic_quotes_runtime(false);
}

So, if MQ runtime is enabled - even "Doing The Right Thing" (turning
it off) will throw deprecated warnings.

-Hannes

16 years ago by Pierre Joye — view source — reply

unread

On Tue, Jun 16, 2009 at 12:33 PM, Hannes
Magnussonhannes.magnusson@gmail.com wrote:

Because in PHP 6 (or next) the function "set_magic_quotes_runtime()" will be
removed, so calling it without checking ini_get() will trigger a fatal
error, no ?

And there is the problem.
The recommended way is:
if(get_magic_quotes_runtime()) {
set_magic_quotes_runtime(false);
}

So, if MQ runtime is enabled - even "Doing The Right Thing" (turning
it off) will throw deprecated warnings.

And as get_magic_quotes_runtime() always returns FALSE,
set_magic_quotes_runtime(false) will never be called.

Cheers,

Pierre

http://blog.thepimp.net | http://www.libgd.org

16 years ago by Keisial — view source — reply

unread

Pierre Joye wrote:

On Tue, Jun 16, 2009 at 12:33 PM, Hannes
Magnussonhannes.magnusson@gmail.com wrote:

Because in PHP 6 (or next) the function "set_magic_quotes_runtime()" will be
removed, so calling it without checking ini_get() will trigger a fatal
error, no ?

And there is the problem.
The recommended way is:
if(get_magic_quotes_runtime()) {
set_magic_quotes_runtime(false);
}

So, if MQ runtime is enabled - even "Doing The Right Thing" (turning
it off) will throw deprecated warnings.

And as get_magic_quotes_runtime() always returns FALSE,
set_magic_quotes_runtime(false) will never be called.

Cheers,

Hannes refers to 5.3. It will work on PHP 6, but on 5.3 it will throw a
the warning despite you doing
the right thing.
I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

16 years ago by Daniel Convissor — view source — reply

unread

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

Thanks,

--Dan

--
T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y
data intensive web and database programming
http://www.AnalysisAndSolutions.com/
4015 7th Ave #4, Brooklyn NY 11232 v: 718-854-0335 f: 718-854-0409

16 years ago by Hannes Magnusson — view source — reply

unread

On Tue, Jun 16, 2009 at 16:00, Daniel
Convissordanielc@analysisandsolutions.com wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

Fair enough.

-Hannes

16 years ago by Greg Beaver — view source — reply

unread

Daniel Convissor wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

I'm sorry, but there is a bug here.

On my system, magic_quotes_gpc is enabled by default, and no
E_DEPRECATED warning is thrown.

Check it out. Compile a vanilla PHP 5.3, and run php -n -i |grep magic

It's probably an oversight, but if it is intentional, we can't punish
people for disabling something that is enabled by default.

Greg

16 years ago by Lukas Kahwe Smith — view source — reply

unread

Daniel Convissor wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to
alert
people of this fact, no matter how the function is used.

I'm sorry, but there is a bug here.

On my system, magic_quotes_gpc is enabled by default, and no
E_DEPRECATED warning is thrown.

Check it out. Compile a vanilla PHP 5.3, and run php -n -i |grep
magic

It's probably an oversight, but if it is intentional, we can't punish
people for disabling something that is enabled by default.

its not about "punishing", its about alerting people that they are
relying on stuff that will go away
E_DEPRECATE is for development only and only as a check you enable
now and then
its off in both of the php.ini's we will ship with 5.3

regards,
Lukas Kahwe Smith
mls@pooteeweet.org

16 years ago by Pierre Joye — view source — reply

unread

hi Lukas,

Daniel Convissor wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

I'm sorry, but there is a bug here.

On my system, magic_quotes_gpc is enabled by default, and no
E_DEPRECATED warning is thrown.

Check it out. Compile a vanilla PHP 5.3, and run php -n -i |grep magic

It's probably an oversight, but if it is intentional, we can't punish
people for disabling something that is enabled by default.

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable now
and then

its off in both of the php.ini's we will ship with 5.3

What Greg meant is:
C:\Users\pierre\Documents\test\php530rc3tsvc9x86>php -n -i |find "magic"
magic_quotes_gpc => On => On
magic_quotes_runtime => Off => Off
magic_quotes_sybase => Off => Off

magic_quotes_gpc should be off by default (default value).

I can commit the change now (as asked on IRC). But Lukas raises the
question about changing default values in minor releases. As they are
off in both php.ini, there is no reason to keep it On by default. Any
opposition before I fix it?

Cheers,

Pierre

http://blog.thepimp.net | http://www.libgd.org

16 years ago by Greg Beaver — view source — reply

unread

Lukas Kahwe Smith wrote:

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable
now and then

its off in both of the php.ini's we will ship with 5.3
OK, then the UPGRADING guide needs a slight revision. It says:

The following ini directives will now emit an E_DEPRECATED warning
upon startup if they are activated:
- define_syslog_variables
- register_globals
- register_long_arrays
- safe_mode
- magic_quotes_gpc

This is incorrect. No E_DEPRECATED is emitted, unless one tries to
disable it.

Greg

16 years ago by Lukas Kahwe Smith — view source — reply

unread

Lukas Kahwe Smith wrote:

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable
now and then

its off in both of the php.ini's we will ship with 5.3
OK, then the UPGRADING guide needs a slight revision. It says:

The following ini directives will now emit an E_DEPRECATED warning
upon startup if they are activated:

define_syslog_variables

register_globals

register_long_arrays

safe_mode

magic_quotes_gpc

AFAIK Kalle worked on adding E_DEP's for these settings at start up
time. Sounds like there is a bug there if they are not showing up for
you. Do you maybe have have start up error's disabled?

This is incorrect. No E_DEPRECATED is emitted, unless one tries to
disable it.

Lets stay a bit of the drama here. If you disable it in the php.ini
you will not see this warning.

regards,
Lukas Kahwe Smith
mls@pooteeweet.org

16 years ago by Hannes Magnusson — view source — reply

unread

Lukas Kahwe Smith wrote:

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable
now and then

its off in both of the php.ini's we will ship with 5.3
OK, then the UPGRADING guide needs a slight revision. It says:

The following ini directives will now emit an E_DEPRECATED warning
upon startup if they are activated:

Thats correct.
bjori@jessica:~$ /usr/src/php/5.3/sapi/cli/php -n -ddefine_syslog_variables=1
PHP Warning: Directive 'define_syslog_variables' is deprecated in PHP
5.3 and greater in Unknown on line 0

However, like I warned about, the warning is thrown so early that
normal users won't ever see it.

-Hannes

16 years ago by Greg Beaver — view source — reply

unread

Hannes Magnusson wrote:

Lukas Kahwe Smith wrote:

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable
now and then

its off in both of the php.ini's we will ship with 5.3

OK, then the UPGRADING guide needs a slight revision. It says:

The following ini directives will now emit an E_DEPRECATED warning
upon startup if they are activated:

Thats correct.
bjori@jessica:~$ /usr/src/php/5.3/sapi/cli/php -n -ddefine_syslog_variables=1
PHP Warning: Directive 'define_syslog_variables' is deprecated in PHP
5.3 and greater in Unknown on line 0

However, like I warned about, the warning is thrown so early that
normal users won't ever see it.
Hi,

If the directive is enabled by default (not by php.ini or by
-ddirective=1) there is no E_DEPRECATED at startup.

try:

php -n -ddisplay_startup_errors=1 -derror_reporting=E_DEPRECATED -r
'var_dump(ini_get("magic_quotes_gpc"));'

Greg

16 years ago by Pierre Joye — view source — reply

unread

Hannes Magnusson wrote:

Lukas Kahwe Smith wrote:

its not about "punishing", its about alerting people that they are
relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you enable
now and then

its off in both of the php.ini's we will ship with 5.3

OK, then the UPGRADING guide needs a slight revision. It says:

The following ini directives will now emit an E_DEPRECATED warning
upon startup if they are activated:

Thats correct.
bjori@jessica:~$ /usr/src/php/5.3/sapi/cli/php -n -ddefine_syslog_variables=1
PHP Warning: Directive 'define_syslog_variables' is deprecated in PHP
5.3 and greater in Unknown on line 0

However, like I warned about, the warning is thrown so early that
normal users won't ever see it.
Hi,

If the directive is enabled by default (not by php.ini or by
-ddirective=1) there is no E_DEPRECATED at startup.

try:

php -n -ddisplay_startup_errors=1 -derror_reporting=E_DEPRECATED -r
'var_dump(ini_get("magic_quotes_gpc"));'

Because it is not set, it is the default value. We have to change the
default value to 0.

Cheers,

Pierre

http://blog.thepimp.net | http://www.libgd.org

16 years ago by Lukas Kahwe Smith — view source — reply

unread

Hi,

This seems like a trivial change from the implementation side, so I am
not worried about changing this for the "better" even after RC4 (given
proper documentation.

So here are the choices I see:

stay as is .. aka defaults to on while not emiting an E_DEPRECATED,
do emit E_DEPRECATED when using the setter
as per Zeev, leave the default as is and change things when using
the setter as follows: "emit E_DEPRECATED in case of true and nothing
in case of false; For 6 - emit an error for true and nothing for
false." (so he is also suggesting to revert the removal of the setter
in PHP6)
stay as is .. aka defaults to on while not emiting an E_DEPRECATED,
but do not emit E_DEPRECATED when using the setter to disable
change the default to off, for the rest stay as is

A few notes:
First up we are late in the RC stage. Also E_DEPRECATED is a "checker
tool" you enable temporarily during development. I expect most people
to use a php.ini supplied by whatever distro they are using or simply
update their current php.ini, in which case they are most likely
setting a value for this setting explicitly, which should cause and
E_DEPRECATED if enabling this feature. I am also not sure which if the
other settings that we are removing in PHP6 are also on by default,
but obviously if we change something here, we are opening pandora's
box to those as well:
- define_syslog_variables
- register_globals
- register_long_arrays
- safe_mode

Please keep things as concise as possible when you reply.

regards,
Lukas

16 years ago by Stefan Walk — view source — reply

unread

its not about "punishing", its about alerting people that they
are relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you
enable now and then

its off in both of the php.ini's we will ship with 5.3

IMHO, if the setting is consistent in both php.inis, the no-ini
behaviour (default value) should be the same ...

Best regards, Stefan

16 years ago by Philip Olson — view source — reply

unread

its not about "punishing", its about alerting people that they
are relying on stuff that will go away

E_DEPRECATE is for development only and only as a check you
enable now and then

its off in both of the php.ini's we will ship with 5.3

IMHO, if the setting is consistent in both php.inis, the no-ini
behaviour (default value) should be the same ...

PHP no longer ships a php.ini file that adheres to default values,
which is something php.ini-dist did in the past. In most (all?) cases,
the default differs for BC reasons.

Regards,
Philip

16 years ago by Zeev Suraski — view source — reply

unread

At 17:00 16/06/2009, Daniel Convissor wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

Why not keep this function then? We can remove the implementation,
for now - emit E_DEPRECATED in case of true and nothing in case of
false; For 6 - emit an error for true and nothing for false. It
just looks compatibility breakage for no good reason.

Zeev

16 years ago by Kalle Sommer Nielsen — view source — reply

unread

2009/6/16 Zeev Suraski zeev@zend.com:

At 17:00 16/06/2009, Daniel Convissor wrote:

Folks:

I propose the following behavior: "Throw a deprecated warning unless
magic quotes are currently enabled and the
parameter is to disable them".

The function is going away. A deprecated warning is necessary to alert
people of this fact, no matter how the function is used.

Why not keep this function then? We can remove the implementation, for now

emit E_DEPRECATED in case of true and nothing in case of false; For 6 -
emit an error for true and nothing for false. It just looks compatibility
breakage for no good reason.

Late timing, but if we want this behaviour then I've written a patch
available at:
http://pastie.org/521077

Removes the deprecation warnings from
magic_quotes_runtime()/set_magic_quotes_runtime(), and only emits one
if:
magic_quotes_runtime(true);

Zeev

--

--
regrads,

Kalle Sommer Nielsen
kalle@php.net