# RFC: Magic Quotes in PHP, the Finalé - Status: Withdrawn - Authors: Daniel Convissor danielc@php.net - Date: 2011-07-18 - Version: 1.0 - Original: https://wiki.php.net/rfc/magicquotes_finale - Page: https://externals.io/rfc/magicquotes_finale - More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt ## Discussions on the mailing list - [\[RFC\] Magic Quotes in PHP, the Finalle](https://externals.io/message/54039.md) — started on 2011-07-18, 28 messages --- ## Introduction Magic Quotes needs to be done away with. This needs to be done in a safe, orderly manner. ## Common Misconceptions 1\) Magic Quotes are already off. While they are set to off in our distributed php.ini files, they are on by default in PHP itself. 2\) Magic Quotes already raise an E\_DEPRECATED message. The message is only raised when explicitly setting “magic\_quotes\_\* = On.” People on systems using PHP's default values do not get any warning about Magic Quotes being deprecated. 3\) Magic Quotes isn't a safety feature. Yes, administrators and programmers relying on this feature are misguided. None the less, there are people (unknowingly) relying on this behavior to escape their SQL statements. Turning it off by default without *explicitly* warning users via the language itself will open security holes. ## Proposal #### 5.4 - Raise E\_DEPRECATED when running the CGI or any web server SAPI and a php.ini file does not contain “magic\_quotes\_gpc = Off”. - PHP's default value for magic\_quotes\_gpc remains as on. #### trunk (5.4 + 1 major release) - Raise E\_ERROR when running the CGI or any web server SAPI and a php.ini file does not contain “magic\_quotes\_gpc = Off”. - Set PHP's default value for magic\_quotes\_gpc to off. #### 5.4 + 2 major releases “removal” What do people think should happen here? Please discuss. ## References - Internals: ["Magic quotes in trunk"](http://marc.info/?t=129001021400001&r=2&w=2), 2010-11-17. ## Changelog - 1.0: Initial version (2011-07-18) - Declined as we ended up removing in 5.4 per