# Magic quotes in trunk - Thread: https://externals.io/message/50301 - Original archive: https://news-web.php.net/php.internals/50301 - Started by Kalle Sommer Nielsen on 2010-11-17T16:08:36+00:00 - Messages: 43 - Page 1 of 2: messages 1 to 25 (25 per page, add `?page=N` to the URL) - Next page: https://externals.io/message/50301.md?page=2 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #50301 — Kalle Sommer Nielsen — 2010-11-17T16:08:36+00:00 URL: https://externals.io/message/50301#50301 Greetings I wanted to raise this topic before we go Alpha with trunk, regarding our beloved magic_quotes feature. There seems to be mixed opinions regarding it so I thought I would take it up for discussion. We have advised people not to use magic_quotes, register_globals and the like for years, and they were marked as deprecated in 5.3.0+ if activated through their php.ini directives. Yet magic_quotes still is set to "On" in 5.3.0. I think its worth we either remove the feature or disable it in trunk as its a security related feature. Lets have a look at what each of those options means: Removing magic_quotes): Means we will remove the feature entirely in the source, we will throw an `E_CORE_ERROR` if activated so people who have it enabled are forced to disable it and make their applications work without magic_quotes. This creates a minor issue for the hosts that simply disable it and have their customers applications run without them which can create a security risk for them, although it should be fairly limited. The functions to check for magic_quotes_runtime should however stay for BC to avoid applications that run on multiple versions of PHP from doing: if(function_exists('...') && ...) Disabling them): This will help to disable the spread of magic_quotes even more, and it can safely be removed in the next major version of PHP. My personal vote here goes towards removing them entirely. What are your inputs on this matter? -- regards, Kalle Sommer Nielsen kalle@php.net --- ## #50302 — Ferenc Kovacs — 2010-11-17T16:12:33+00:00 URL: https://externals.io/message/50301#50302 · In reply to: #50301 > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an `E_CORE_ERROR` if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net > > -- > > > > +1 for removing it. Tyrael --- ## #50303 — Pierrick Charron — 2010-11-17T16:14:11+00:00 URL: https://externals.io/message/50301#50303 · In reply to: #50301 +1 for removing it in trunk Pierrick > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an `E_CORE_ERROR` if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net --- ## #50304 — Uwe Schindler — 2010-11-17T16:28:07+00:00 URL: https://externals.io/message/50301#50304 · In reply to: #50301 Yeah, +1 for remove! ----- Uwe Schindler thetaphi@php.net - http://www.php.net NSAPI SAPI developer Bremen, Germany > -----Original Message----- > From: kalle.php@gmail.com [mailto:kalle.php@gmail.com] On Behalf Of Kalle > Sommer Nielsen > Sent: Wednesday, November 17, 2010 5:09 PM > To: Internals > Subject: [PHP-DEV] Magic quotes in trunk > > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding our > beloved magic_quotes feature. There seems to be mixed opinions regarding it > so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and the like > for years, and they were marked as deprecated in 5.3.0+ if activated through > their php.ini directives. Yet magic_quotes still is set to "On" in 5.3.0. I think its > worth we either remove the feature or disable it in trunk as its a security > related feature. Lets have a look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw an > `E_CORE_ERROR` if activated so people who have it enabled are forced to > disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and have their > customers applications run without them which can create a security risk for > them, although it should be fairly limited. The functions to check for > magic_quotes_runtime should however stay for BC to avoid applications that > run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it can > safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net > > -- > To unsubscribe, visit: > http://www.php.net/unsub.php --- ## #50305 — Olivier Hill — 2010-11-17T16:40:09+00:00 URL: https://externals.io/message/50301#50305 · In reply to: #50301 My opinion is to remove them completely. Big +1 from me. It is time for the feature to go. Olivier (iPhone) Le 2010-11-17 à 11:08, Kalle Sommer Nielsen a écrit : > Greetings > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net --- ## #50306 — james.butler@edigitalresearch.com — 2010-11-17T16:44:07+00:00 URL: https://externals.io/message/50301#50306 · In reply to: #50301 +1 for removal, magic quotes stopped being a 'good' thing to do back when I first learnt what echo did. Web hosts etc have plenty of version numbers to catch up on/upgrade too before they get to this being a problem. (well most anyway) -----Original Message----- From: kalle@php.net [mailto:kalle.php@gmail.com] On Behalf Of Kalle Sommer Nielsen Sent: 17 November 2010 16:09 To: Internals Subject: [PHP-DEV] Magic quotes in trunk My personal vote here goes towards removing them entirely. What are your inputs on this matter? -- regards, Kalle Sommer Nielsen kalle@php.net --- ## #50313 — Adam Harvey — 2010-11-18T03:46:33+00:00 URL: https://externals.io/message/50301#50313 · In reply to: #50301 > What are your inputs on this matter? +1 for removing magic quotes completely from trunk. Kill it with fire. Adam --- ## #50314 — Stanley Sufficool — 2010-11-18T03:50:25+00:00 URL: https://externals.io/message/50301#50314 · In reply to: #50301 +1 for removal --- ## #50315 — Dallas Gutauckis — 2010-11-18T04:03:06+00:00 URL: https://externals.io/message/50301#50315 · In reply to: #50314 +1 for removal On Wed, Nov 17, 2010 at 10:50 PM, Stanley Sufficool wrote: > +1 for removal --- ## #50317 — Thomas Hruska — 2010-11-18T05:01:01+00:00 URL: https://externals.io/message/50301#50317 · In reply to: #50313 > > > […] > > +1 for removing magic quotes completely from trunk. Kill it with fire. > > Adam +infinity. Burn baby burn. (Hudson Ford reference intended...unless that makes me too old.) -- Thomas Hruska CubicleSoft President Barebones CMS is a high-performance, open source content management system for web developers operating in a team environment. An open source CubicleSoft initiative. Your choice of a MIT or LGPL license. http://barebonescms.com/ --- ## #50319 — Philip Olson — 2010-11-18T05:19:05+00:00 URL: https://externals.io/message/50301#50319 · In reply to: #50301 > What are your inputs on this matter? I'm struggling with this topic. We must do something, but it's important to understand that plenty of people unknowingly rely upon this security feature that's still enabled by default. Granted 5.3 does generate `E_DEPRECATED` errors when magical quotes are enabled, but is one minor PHP version of errors enough to go from on to gone? So while those in the know (e.g., people who follow this list) find them annoying and wish they never existed, what are the implications? I'm still unsure how best to handle this situation but wanted to express these feelings now. Whatever the case, the education effort towards data filtering and sanitization requires a lot of improvement. Regards, Philip --- ## #50320 — Larry Garfield — 2010-11-18T05:40:37+00:00 URL: https://externals.io/message/50301#50320 · In reply to: #50319 > > […] > > I'm struggling with this topic. We must do something, but it's important to > understand that plenty of people unknowingly rely upon this security > feature that's still enabled by default. Granted 5.3 does generate > `E_DEPRECATED` errors when magical quotes are enabled, but is one minor PHP > version of errors enough to go from on to gone? > > So while those in the know (e.g., people who follow this list) find them > annoying and wish they never existed, what are the implications? I'm still > unsure how best to handle this situation but wanted to express these > feelings now. Whatever the case, the education effort towards data > filtering and sanitization requires a lot of improvement. > > Regards, > Philip I won't miss magic quotes if they're removed, but I can see the argument for saying "not quite yet". Off-by-default is absolutely necessary if they're kept. (Dear god, you mean they aren't off by default already?) --Larry Garfield --- ## #50322 — Philip Olson — 2010-11-18T06:42:43+00:00 URL: https://externals.io/message/50301#50322 · In reply to: #50320 > > > […] > > I won't miss magic quotes if they're removed, but I can see the argument for > saying "not quite yet". Off-by-default is absolutely necessary if they're > kept. (Dear god, you mean they aren't off by default already?) > > --Larry Garfield This is true. And in addition to the `E_DEPRECATED` error, it's worth mentioning that 5.3 includes two optional php.ini-* files (php.ini-production and php.ini-development) that disable magic quotes. But of course not everyone uses these, and "default" is how PHP behaves without a php.ini file. Older versions of PHP include php.ini-dist (On) and php.ini-recommended (Off). Regards, Philip --- ## #50323 — Zeev Suraski — 2010-11-18T07:22:13+00:00 URL: https://externals.io/message/50301#50323 · In reply to: #50320 > -----Original Message----- > From: Larry Garfield [mailto:larry@garfieldtech.com] > Sent: Thursday, November 18, 2010 7:41 AM > To: internals@lists.php.net > Subject: Re: [PHP-DEV] Magic quotes in trunk > > > > […] > but > > […] > > I won't miss magic quotes if they're removed, but I can see the argument for > saying "not quite yet". Off-by-default is absolutely necessary if they're kept. > (Dear god, you mean they aren't off by default already?) The voice of reason... As much as I'd like to see magic quotes burning in hell (had the option to kill them when they were small, but unfortunately didn't), I'm wondering whether the people +1'ing are thinking about the potential consequences to doing this, and if they're also volunteering to respond (nicely!!) to the endless complaints, flames, and just general "what happened???!!!" mailing list emails that may flood us when this happens. With 6.0, we talked about having prepend-scripts that emulate magic quotes available, since like it or not - there are probably billions of lines of code out there that rely on the existence of magic quotes. I don't have a strong opinion on whether we should remove magic quotes altogether in 5.4 and provide emulation instructions, or just disable it by default as a first step. Zeev --- ## #50324 — Adam Harvey — 2010-11-18T07:40:11+00:00 URL: https://externals.io/message/50301#50324 · In reply to: #50323 > As much as I'd like to see magic quotes burning in hell (had the option to kill them when they were small, but unfortunately didn't), I'm wondering whether the people +1'ing are thinking about the potential consequences to doing this, and if they're also volunteering to respond (nicely!!) to the endless complaints, flames, and just general "what happened???!!!" mailing list emails that may flood us when this happens.  With 6.0, we talked about having prepend-scripts that emulate magic quotes available, since like it or not - there are probably billions of lines of code out there that rely on the existence of magic quotes. I already help support users on IRC — good support channels have been recommending against the use of magic quotes for ages anyway. Yes, killing magic quotes will likely increase the support workload for a time, but I do think it's worth it because in the longer run it'll force people to write better code. Having it deprecated in the 5.3 series seems like sufficient warning to me. At any rate, pulling the trigger and removing it from trunk will help get the word out long before 5.4 has a stable release. I mean, I take the point about it seeming sudden from a userland perspective, but I just think the pros (vastly) outweigh the cons here. Adam --- ## #50325 — Kalle Sommer Nielsen — 2010-11-18T08:05:22+00:00 URL: https://externals.io/message/50301#50325 · In reply to: #50323 2010/11/18 Zeev Suraski : > The voice of reason... > As much as I'd like to see magic quotes burning in hell (had the option to kill them when they were small, but unfortunately didn't), I'm wondering whether the people +1'ing are thinking about the potential consequences to doing this, and if they're also volunteering to respond (nicely!!) to the endless complaints, flames, and just general "what happened???!!!" mailing list emails that may flood us when this happens.  With 6.0, we talked about having prepend-scripts that emulate magic quotes available, since like it or not - there are probably billions of lines of code out there that rely on the existence of magic quotes. > I don't have a strong opinion on whether we should remove magic quotes altogether in 5.4 and provide emulation instructions, or just disable it by default as a first step. I think we either should kill it or disable it now and remove it in the next major version of PHP, be that 5.5 or 6.0. I don't think we should provide emulation instructions, but rather some improved chapters in the manual about what they are, how they work and how to make sure applications are "protected" / compatible against them, so even the basis PHP developer takes it into consideration. Because even doing: $mysqli->query('SELECT * FROM `developers` WHERE `username` = \'' . $_GET['username'] . '\'); is bad with or without magic_quotes, theres a security issue non the less if people are writing code like that. I think we need to better educate our developers about these features, and I wouldn't mind writing some manual pages regarding this we can advertise with the release. Or at least find out how big a problem with would be, because there are still many companies with legacy code applications running an ancient version of PHP and never would upgrade or similar reasons. But all in all, I think it depends on us advertising it properly in the manual, how to deal with it that is. -- regards, Kalle Sommer Nielsen kalle@php.net --- ## #50326 — johannes@schlueters.de — 2010-11-18T09:51:29+00:00 URL: https://externals.io/message/50301#50326 · In reply to: #50324 > Yes, killing magic quotes will likely increase the support workload > for a time, I don't think it would increase support workload. Most people won't notice. What happens is that applications which are _a bit_ secure now will continue to run as before but become _completely_ insecure as there, unfortunately, are many users who don't know about the different issues. Code like mysql_query("SELECT id FROM table WHERE name = '".$_GET['name']."'"); is not too easy to exploit right now. As soon as m_q is gone it's trivial to exploit. And people won't notice. And lots of such code exists. Maybe not with internals subscribers, but there are enough people who learned programming just last week using PHP and have the $1 hosting package ... and many of these things live "forever". I think the default can only be changed in a change which breaks "a lot". To be clear: I am NOT saying that m_q is secure or safe. But dropping it lowers he bar quite a lot. johannes, who said this in multiple threads before ;-) --- ## #50330 — Richard Quadling — 2010-11-18T10:07:30+00:00 URL: https://externals.io/message/50301#50330 · In reply to: #50301 > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an `E_CORE_ERROR` if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net Certainly +1 for removal, but wasn't there some discussion a LONG while ago about when this should be? I would have thought that anything deprecated would best be removed at the next major release. So that makes it gone for V6 - when ever that may be. Richard -- Richard Quadling Twitter : EE : Zend @RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY --- ## #50332 — Arvids Godjuks — 2010-11-18T10:19:32+00:00 URL: https://externals.io/message/50301#50332 · In reply to: #50330 +1 for removal. The issue is that those ho still use the soft witch relies on magic_quotes are usually kind of people witch are just buying the Indian code stuff and running it (and it has tons of exploits on it's own - even with magic_quotes). No, really, I haven't seen the magic_quotes stuff in ages even in open source. Most of the things that use it runs on 4.4.x and just unable to run on 5.x+ due to bad coding and not following the trends. There always will be people, who will whine about magic_quotes being gone. Same as register_globals. BTW, will the register_globals will be finally dropped too? ;) --- ## #50333 — Kalle Sommer Nielsen — 2010-11-18T10:21:36+00:00 URL: https://externals.io/message/50301#50333 · In reply to: #50332 Hi 2010/11/18 Arvids Godjuks : > There always will be people, who will whine about magic_quotes being > gone. Same as register_globals. BTW, will the register_globals will be > finally dropped too? ;) I dropped a bunch of legacy features together with Pierrick during this summer, so yes register_globals are gone along with safe_mode: http://php.net/php6news -- regards, Kalle Sommer Nielsen kalle@php.net --- ## #50336 — Patrick ALLAERT — 2010-11-18T10:41:26+00:00 URL: https://externals.io/message/50301#50336 · In reply to: #50301 2010/11/17 Kalle Sommer Nielsen : > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an `E_CORE_ERROR` if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net > > -- > > I am all for removing it but... Disabling it by default is the first mandatory step, [done] in PHP 5.3, magic_quotes_gpc has been turned off by default at the same time as providing a -development and -production version of the php.ini file. However, such a change might be risky in the PHP5 series! Release the exact same thing as PHP 5.4 or PHP 6, there is a big difference in the user perception. * Is my PHP 5.x application compatible with PHP 6? * Chance is higher that they will take more care reading a PHP 5.3 -> PHP 6 Migration guide than a 5.3 -> 5.4. +1 to remove it in PHP > 5 Patrick --- ## #50337 — Ferenc Kovacs — 2010-11-18T10:47:55+00:00 URL: https://externals.io/message/50301#50337 · In reply to: #50336 On Thu, Nov 18, 2010 at 11:41 AM, Patrick ALLAERT wrote: > 2010/11/17 Kalle Sommer Nielsen : > > […] > > I am all for removing it but... > Disabling it by default is the first mandatory step, [done] in PHP > 5.3, magic_quotes_gpc has been turned off by default at the same time > as providing a -development and -production version of the php.ini > file. > > However, such a change might be risky in the PHP5 series! > Release the exact same thing as PHP 5.4 or PHP 6, there is a big > difference in the user perception. > * Is my PHP 5.x application compatible with PHP 6? > * Chance is higher that they will take more care reading a PHP 5.3 -> > PHP 6 Migration guide than a 5.3 -> 5.4. > > +1 to remove it in PHP > 5 > > Patrick > > -- > > > > by your logic, the same goes for register_globals and for the other deprecated stuff, that we wanted to remove with the next major version. maybe we should look this the other way around: if we agree that this things have to go, and the only thing which blocks that is the version number, then maybe we should ship something > 5 Tyrael --- ## #50338 — Jani Taskinen — 2010-11-18T10:48:50+00:00 URL: https://externals.io/message/50301#50338 · In reply to: #50336 > Disabling it by default is the first mandatory step, [done] in PHP > 5.3, magic_quotes_gpc has been turned off by default at the same time > as providing a -development and -production version of the php.ini > file. AFAICT magic_quotes_gpc is still "On" in PHP_5_3 and trunk if you don't use any php.ini: $ php -n --ri core | grep magic magic_quotes_gpc => On => On magic_quotes_runtime => Off => Off magic_quotes_sybase => Off => Off Or what did you mean? :) --Jani --- ## #50339 — james.butler@edigitalresearch.com — 2010-11-18T10:50:17+00:00 URL: https://externals.io/message/50301#50339 · In reply to: #50301 The only problem I can see with this is... do we wait for PHP6 as it seems to be becoming a bit of a Perl 6 (sorry for bringing this up)? I completely agree with it should only happen with major version change and most people won't see 5.x -> 5.y being a major change and therefore the end user expectation will be for things to generally to carry on working I'm not sure what the best answer is apart from jumping ahead with a PHP6, but is it really worth jumping the gun just for MQ's etc? -----Original Message----- From: patrickallaert@php.net [mailto:patrick.allaert@gmail.com] On Behalf Of Patrick ALLAERT Sent: 18 November 2010 10:41 To: Kalle Sommer Nielsen Cc: Internals Subject: Re: [PHP-DEV] Magic quotes in trunk 2010/11/17 Kalle Sommer Nielsen : > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an `E_CORE_ERROR` if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > kalle@php.net > > -- > > I am all for removing it but... Disabling it by default is the first mandatory step, [done] in PHP 5.3, magic_quotes_gpc has been turned off by default at the same time as providing a -development and -production version of the php.ini file. However, such a change might be risky in the PHP5 series! Release the exact same thing as PHP 5.4 or PHP 6, there is a big difference in the user perception. * Is my PHP 5.x application compatible with PHP 6? * Chance is higher that they will take more care reading a PHP 5.3 -> PHP 6 Migration guide than a 5.3 -> 5.4. +1 to remove it in PHP > 5 Patrick --- ## #50340 — Kalle Sommer Nielsen — 2010-11-18T10:51:18+00:00 URL: https://externals.io/message/50301#50340 · In reply to: #50337 2010/11/18 Ferenc Kovacs : > by your logic, the same goes for register_globals and for the other > deprecated stuff, that we wanted to remove with the next major version. > maybe we should look this the other way around: if we agree that this things > have to go, and the only thing which blocks that is the version number, then > maybe we should ship something > 5 (see my previous mail) All of these so called legacy features (in my perspective) except magic_quotes were removed: http://php.net/php6news and as Jani noted, its on by default if no php.ini file is used (hardcoded into the binary to fallback to "On") -- regards, Kalle Sommer Nielsen kalle@php.net --- Next page: https://externals.io/message/50301.md?page=2