Write PHP apps that are not affected by magic quotes

Read the premise: you must read the "Part IV Security" chapter "10th Magic Quotes" in the PHP manual. If you haven't seen it, it's no problem, now take 10 minutes to read this in the PHP manual first.

Magic Quotes (Magic Quote) is a process that automatically escapes data into PHP scripts

You may want your program to be compatible with multiple databases, but the different databases you use may use different escape characters, and our programs may run on different php.ini configured hosts, and the configuration of magic_quotes may not be the same. So writing PHP applications that are not affected by magic quotes is a must for high-compatibility PHP applications.

There are three Magic quote configuration options in php.ini:

Magic Quotes configuration Options	Describe	Run-time change	The default value in PHP is
Magic_quotes_gpc	If opened, it affects HTTP request data (Get,post and cookies).	No	On
Magic_quotes_runtime	If open, most of the functions that get data from external sources and return the data, including from the database and text files, are escaped by backslashes. (If MAGIC_QUOTES_GPC = ON)	Yes	Off
Magic_quotes_sybase	When closed, all ' (single quotes), "(double quotes),/(backslashes), and NULL characters are automatically added with a backslash to escape. This is exactly the same as the addslashes () function. If turned on, single quotes are escaped using single quotes instead of backslashes. This option will completely overwrite the MAGIC_QUOTES_GPC. If you open two options at the same time, the single quotes will be escaped to '. Double quotes, backslashes, and NULL characters are not escaped. (If MAGIC_QUOTES_GPC = ON)	Yes	Off

But dealing with external global variables is a bit of a hassle.

To handle an external super variable, we want to see if the MAGIC_QUOTES_GPC is open (if MAGIC_QUOTES_GPC is not open and magic_quotes_sybase is turned on, Magic_quotes_sybase does not work), Also depends on whether the magic_quotes_sybase open, and then see if our program requires an external variable with addslashes escape mode or use Magic_quotes_sybase-type escape mode. The following code is a concrete implementation.

Some may say that when MAGIC_QUOTES_GPC is set to ON, and Magic_quotes_sybase is set to off, then directly with Ini_set (' Magic_quotes_sybase ', 1); You can have the system use ' to cover the addslashes-type escape. This is not going to work. You use the Ini_get (' magic_quotes_sybase ') output to look at the configuration, Magic_quotes_sybase has indeed been changed, but your code is not able to use the ' escape character override Addslashes automatic escape. This is because the system gets the external variable when it is in your ini_set (' magic_quotes_sybase ', 1);

/**
* Solve PHP applications that are not affected by magic_quotes
*
* Use this method to configure whether to use Magic_quotes_sybase to adapt to different DBMS
*
* Setup Method:
* $useQuotesSybase [database name] = 1;
* For example: Using SQLite, define and initialize the $useQuotesSybase [' sqlite '] = 1;
* If you use MySQL, you can define and initialize $useQuotesSybase [' sqlite '] = 0; You can also not define
*
* Config_db_dbms is a constant of the DBMS used and is defined elsewhere. such as define (' Config_db_dbms ', ' MySQL ');
*
* @author Water Mengchun cmpan (at) qq.com
* @link http://lib.cublog.cn
* $date 2007.11.18
*/
Error_reporting (E_all);
Set_magic_quotes_runtime (0);
Define (' Config_db_dbms ', ' SQLite '); For testing

Using the ' escape character ' database
$useQuotesSybase = Array ();
$useQuotesSybase [' sqlite '] = 1;
$useQuotesSybase [' sybase '] = 1;

if (!empty ($_post)) $_post = Array_map (' Quotesoutervars ', $_post);
if (!empty ($_get)) $_get = Array_map (' Quotesoutervars ', $_get);
$_cookie = Array_map (' Quotesoutervars ', $_cookie);
$_request = Array_map (' Quotesoutervars ', $_request);

function Quotesoutervars ($var) {
if (Is_array ($var)) {
Return Array_map (' Quotesoutervars ', $var);
} else {
if (GET_MAGIC_QUOTES_GPC ()) {
if (Isset ($GLOBALS [' usequotessybase '][config_db_dbms]) && $GLOBALS [' usequotessybase '][config_db_dbms]) {
The current need to ' escape character '
If magic_quotes_sybase = Off, the system will addslashes the external variables, we'll have to stripslashes
Otherwise the system will automatically "replace",
if (!ini_get (' magic_quotes_sybase ')) {
$var = Stripslashes ($var);
$var = Str_replace ("'", "'", $var);
}
} else {
Current need to/as escape character
If Magic_quotes_sybase = ON, we first replace ' ', and then addslashes
Otherwise the system automatically quotes
if (Ini_get (' magic_quotes_sybase ')) {
$var = Str_replace ("'", "'", $var);
$var = Addslashes ($var);
}
}
} else{
if (Isset ($GLOBALS [' usequotessybase '][config_db_dbms]) && $GLOBALS [' usequotessybase '][config_db_dbms]) {
$var = Str_replace ("'", "'", $var);
} else {
$var = Addslashes ($var);
}
}

Return trim ($var);
}
}

From the table above we can see that for magic_quotes_runtime, I am in the program with Ini_set (' Magic_quotes_runtime ', 0), you can turn it off, and then you can use their own methods to process data from the database or file.

