PHP - Manual: get_magic_quotes_gpc

2024-11-14

get_magic_quotes_runtime »

« get_loaded_extensions

get_magic_quotes_gpc

(PHP 4, PHP 5, PHP 7)

get_magic_quotes_gpc — 获取当前 magic_quotes_gpc 的配置选项设置

警告

本函数已自 PHP 7.4.0 起废弃。强烈建议不要使用本函数。

说明

get_magic_quotes_gpc(): bool

始终返回 false。

返回值

始终返回 false。

更新日志

版本	说明
7.4.0	该函数已被废弃。

参见

addslashes() - 使用反斜线引用字符串
stripslashes() - 反引用一个引用字符串
get_magic_quotes_runtime() - 获取当前 magic_quotes_runtime 配置选项的激活状态
ini_get() - 获取一个配置选项的值

add a note

User Contributed Notes 10 notes

down

heiko dot richler at informatik dot fh-nuernberg dot de ¶

14 years ago


@ dot dot dot dot dot alexander at gmail dot com


I suggest replacing foreach by "stripslashes_deep":


Example #2 Using stripslashes() on an array on 

<http://www.php.net/manual/en/function.stripslashes.php>:


<?php

function stripslashes_deep($value)

{

    $value = is_array($value) ?

                array_map('stripslashes_deep', $value) :

                stripslashes($value);


    return $value;

}

?>



This gives:


<?php

if((function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc())    || (ini_get('magic_quotes_sybase') && (strtolower(ini_get('magic_quotes_sybase'))!="off")) ){

    stripslashes_deep($_GET);

    stripslashes_deep($_POST);

    stripslashes_deep($_COOKIE);

}

?>

down

eltehaem at poczta dot onet dot pl ¶

17 years ago


Please note, that when magic_quotes_gpc is set not only $_POST, $_GET, $_REQUEST, $_COOKIE arrays values are slashed. Actually every string value in $GLOBALS array is slashed, ie. $GLOBALS['_SERVER']['PATH_INFO'] (or $_SERVER['PATH_INFO']).

down

slonmron_no_spam_please_ at yahoo dot com ¶

15 years ago


Re: php at kaiundina dot de (03-Feb-2005 02:18)

1. magic_quotes_gpc=on/off and magic_quotes_sybase=on/off

I made test and your function worked right. 
These were the <input ... /> names I used:
name="a"
name="b.b b\b"
name="c[c.1]"
name="c[c 2]"
name="c[c\3]"
name="c.c c[c.' 4]"
name="c ' c[c&quot;4]"
name="d&quot;[d&quot;1]"

(I used &quot; because I don't know other way to put " into the name)

and the user-input value:
a ' " \ \' \" \\ a

2. > 17) The chars '.', ' ' are always replaced by '_' when used in keys.

This is true only for the top-level keys, such as "b.b b\b", "c.c c" and "c ' c" above. The second-level key "[c.' 4]" was not changed to [c_'_4] but was escaped acording to how magic_quites_XXX are set.

Tested on PHP 4.4.0.

These magic_quotes are really black magic :(

It'll be good to make test against $_SESSION, but I can't do it today.

down

louis at greynoise dot co dot uk ¶

14 years ago


<?php

function stripper($stringvar){

    if (1 == get_magic_quotes_gpc()){

        $stringvar = stripslashes($stringvar);

    }

    return $stringvar;

}

?>



Usage:


<?php

$Body = stripper($rs->fields('Body'));

echo($Body);

?>



This checks if get_magic_quotes_gpc() is on and strips a string variable for output if its on. Useful if the dev server and live server are set up different.

down

hetored at gmail dot com ¶

12 years ago


Here's what I came up with to remove magic quotes from request data.

Replaces two single-quotes with one if magic_quotes_sybase are on, otherwise it just strips slashes.

Note that the `foreach` style makes this work only with PHP 5 and above.

<?php

// Strip magic quotes from request data.
if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
    // Create lamba style unescaping function (for portability)
    $quotes_sybase = strtolower(ini_get('magic_quotes_sybase'));
    $unescape_function = (empty($quotes_sybase) || $quotes_sybase === 'off') ? 'stripslashes($value)' : 'str_replace("\'\'","\'",$value)';
    $stripslashes_deep = create_function('&$value, $fn', '
        if (is_string($value)) {
            $value = ' . $unescape_function . ';
        } else if (is_array($value)) {
            foreach ($value as &$v) $fn($v, $fn);
        }
    ');
    
    // Unescape data
    $stripslashes_deep($_POST, $stripslashes_deep);
    $stripslashes_deep($_GET, $stripslashes_deep);
    $stripslashes_deep($_COOKIE, $stripslashes_deep);
    $stripslashes_deep($_REQUEST, $stripslashes_deep);
}

?>

down

php at kaiundina dot de ¶

17 years ago


Escaping of key-strings in GPC-arrays behave different to the escaping of their values.


First I expected that keys in submitted gpc-arrays are never escaped.

Anyway. After I saw escaped keys, I assumed they're escaped according to the settings of magic quotes.

... it's even worse...


It took me over 2 days of testing to figure out the exact behavior and creating two functions (one for each php-version) that strips slashes reliably from any array submitted to a script. Hope this saves someones time and nerves.


The following is true for $_GET- and $_POST-arrays. I hope other arrays affected by magic quotes behave equally.

I did not test the behavior for cases where magic_quotes_sybase is set.


== legend for possible case combinations ==

Px = php version we're using

    P4 = php 4.3.9

    P5 = php 5.0.2


MQ = MagicQuotes GPC

    +MQ = magic quotes enabled

    -MQ = magic quotes disabled


TL = TopLevel key

    +TL = key is on top level (i.e. $_GET['myKey'])

    -TL = key is nested within another array (i.e. $_GET['myList']['myKey'])


AK = ArrayKey

    +AK = the value of the key is another array (i.e. is_array($_GET['myKey']) == true)

    -AK = the value is a normal string (i.e. is_string($_GET['myKey']) == true)


== legend for possible results ==

KE = KeyEscaping

    +KE = control chars are prefixed with a backslash

    -KE = key is returned as submitted and needn't to be stripped


VE = ValueEscaping (doesn't apply for array as value)

    +VE = control chars are prefixed with a backslash

    -VE = value is returned as submitted and needn't to be stripped


== here we go - the following rules apply ==

 1) P4 +MQ +AK +TL --> -KE

 2) P4 +MQ +AK -TL --> +KE

 3) P4 +MQ -AK +TL --> -KE +VE

 4) P4 +MQ -AK -TL --> +KE +VE

 5) P4 -MQ +AK +TL --> -KE

 6) P4 -MQ +AK -TL --> -KE

 7) P4 -MQ -AK +TL --> -KE -VE

 8) P4 -MQ -AK -TL --> -KE -VE

 9) P5 +MQ +AK +TL --> -KE

10) P5 +MQ +AK -TL --> +KE

11) P5 +MQ -AK +TL --> +KE +VE

12) P5 +MQ -AK -TL --> +KE +VE

13) P5 -MQ +AK +TL --> -KE

14) P5 -MQ +AK -TL --> -KE

15) P5 -MQ -AK +TL --> +KE -VE

16) P5 -MQ -AK -TL --> +KE -VE

17) The chars '.', ' ' are always replaced by '_' when used in keys.


Example (rule 15):

When running under php 5.0.2 having magic quotes disabled, gpc-keys on top level containing strings are escaped while their associated values are not.


== The following function will strip GPC-arrays for php 4.3.9 ==


<?php

function transcribe($aList, $aIsTopLevel = true) {

    $gpcList = array();

    $isMagic = get_magic_quotes_gpc();

    

    foreach ($aList as $key => $value) {

        $decodedKey = ($isMagic && !$aIsTopLevel)?stripslashes($key):$key;

        if (is_array($value)) {

            $decodedValue = transcribe($value, false);

        } else {

            $decodedValue = ($isMagic)?stripslashes($value):$value;

        }

        $gpcList[$decodedKey] = $decodedValue;

    }

    return $gpcList;

}

?>




== The following function will strip GPC-arrays for php 5.0.2 ==

<?php

function transcribe($aList, $aIsTopLevel = true) {

    $gpcList = array();

    $isMagic = get_magic_quotes_gpc();

    

    foreach ($aList as $key => $value) {

        if (is_array($value)) {

            $decodedKey = ($isMagic && !$aIsTopLevel)?stripslashes($key):$key;

            $decodedValue = transcribe($value, false);

        } else {

            $decodedKey = stripslashes($key);

            $decodedValue = ($isMagic)?stripslashes($value):$value;

        }

        $gpcList[$decodedKey] = $decodedValue;

    }

    return $gpcList;

}

?>



Usage:


<?php

$unstrippedGET = transcribe($_GET);

$unstrippedPOST = transcribe($_POST);

?>



Maybe someone is willing to test those combinations for other php-versions and with magic_quotes_sybase set to 'on' - let me know.

Sorry for this huge amount of text, but it's complete. I was unable to compress the decision table more than this.

down

venimus at gmail dot com ¶

15 years ago


When you work with forms and databases you should use this concept:

1.When inserting the user input in DB escape $_POST/$_GET with add_slashes() or similar (to match the speciffic database escape rules)

$query='INSERT INTO users SET fullname="'.add_slashes($_POST['fullname']).'"';
insert_into_db($query);

2.When reading a previously submitted input from DB use html_special_chars to display an escaped result!

read_db_row('SELECT fullname FROM users');
echo '<input type="text" name="fullname" value="'.html_special_chars($db_row['fullname']).'" />

this way you safely store and work with the original(unescaped) data.

down

-1

w3dk ¶

7 years ago


> "If the directive magic_quotes_sybase is ON it will completely override magic_quotes_gpc."

This "note" is a bit misleading. magic_quotes_sybase will only override the escaping method used on Get/Post/Cookie data if magic_quotes_gpc is already enabled. If magic_quotes_gpc is not enabled then magic_quotes_sybase will have no effect here.

A few of the other comments are therefore incorrect in determining when to "stripslashes" from the input, by "stripping slashes" when either magic_quotes_gpc OR magic_quotes_sybase is enabled. You should only stripslashes() when magic_quotes_gpc is enabled since that is the only time when slashes are automatically added.

stripslashes() is also magic_quotes_sybase aware, so you don't need to do anything special (ie. write a custom function to handle this situation as another comment suggests) when magic_quotes_sybase is enabled. When magic_quotes_sybase is enabled, stripslashes() does not actually strip any slashes, but instead unescapes single-quotes that are escaped with single-quotes only.

magic_quotes_sybase does however influence the escaping (and unescaping) method used by addslashes() and stripslashes() respectively, regardless of whether magic_quotes_gpc (or magic_quotes_runtime) is enabled.

down

-1

dot dot dot dot dot alexander at gmail dot com ¶

14 years ago


Just a little correction:
( Because of the ini_get function that may return a string value of "off" that evaluates to TRUE )
<?php
        if(   
            (  function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()  )
             || (  ini_get('magic_quotes_sybase') && ( strtolower(ini_get('magic_quotes_sybase')) != "off" )  )
           ){
            foreach($_GET as $k => $v) $_GET[$k] = stripslashes($v);
            foreach($_POST as $k => $v) $_POST[$k] = stripslashes($v);
            foreach($_COOKIE as $k => $v) $_COOKIE[$k] = stripslashes($v);
        }
?>

down

-5

rogier at dsone ¶

9 years ago


Regarding the three main strip methods as found below (two using foreach, 1 using the json method), I've done a little benchmarking using 'true' profiling (using a registered tickhandler where declare(ticks=1)).

I wondered whether or not json would not be terribly slow.

I won't discuss the profiler, but will suffice with the following statement, followed by the used code to benchmark:


The json method was by FAR the quickest (contrary to what I'd thought), so if you need a speedy process, use that!


<?php

declare(ticks=1);

function g()

{

    return array(

        'a'=>'i\\\\\\'m',

        array('a1' => 'x', 'b1' => 'x'),

        array( 'a2' => array('a3' => '\\\\\\'x', 'b3' => 'random' )

        )

    );

}


function strip_json($d)

{

    $rs = json_decode(stripslashes(json_encode($d, JSON_HEX_APOS)), true);

    return $rs;

}


function strip_deep1($d)

{

    foreach ($d as $k=>$v)

    {

        if (is_array($v)) { $d[$k] = strip_deep1($v); }

        else { $d[$k] = stripslashes($v); }

    }

    return $d;

}


function strip_deep2(&$d)

{

    $d = is_array($d) ? array_map('strip_deep2', $d) : stripslashes($d);

    return $d;

}


// now profile it

require_once './TickProfiler.php';

$N = 1000;

$d = g();

TickProfiler::Register();

for ($i = 0; $i < $N; $i++){ strip_json($d); }

for ($i = 0; $i < $N; $i++){ strip_deep1($d); }

for ($i = 0; $i < $N; $i++){ strip_deep2($d); }

TickProfiler::Unregister();

TickProfiler::Display();


?>



My output (PHP 5.3.1, win32):

    [TickProfiler::tick] => Array

        (

            [time] => 0.76188707351685

            [calls] => 46001

        )


    [TickProfiler::Register] => Array

        (

            [time] => 3.0994415283203E-5

            [calls] => 1

        )


    [strip_json] => Array

        (

            [time] => 0.025638580322266

            [calls] => 1000

        )


    [strip_deep1] => Array

        (

            [time] => 0.40303444862366

            [calls] => 36000

        )


    [strip_deep2] => Array

        (

            [time] => 0.14928555488586

            [calls] => 9000

        )


)


As can be seen above, using json speeds output by at least a factor of 5 (nearly 6).

Just wanted to share this :D


Do note the strip_json function has two LOC instead of a plain return statement, otherwise it wouldn't get picked up by the tickprofiler (it would return from the code immediately, never reaching the profiler)!


Usage of the return statement in strip_deep2 is not needed, as the argument is passed by reference.

A new test showed that the time penalty for this is about 0.09 seconds.


This actually means that the factor between strip_deep2 vs strip_json is only about 2.

Still, strip_json would be about twice as fast as strip_deep2

add a note

官方地址：https://www.php.net/manual/en/function.get-magic-quotes-gpc.php

有任何技术问题请点击这里网站运营推广招聘

IT PHP 编程语言 Linux 开发编程科技 Elasticsearch HTML/CSS/XML 网络 JAVA NoSQL 数据库面试 C/C++ Golang Git 算法操作系统正则表达式 Redis 互联网 MySql JavaScript 运维软件国际架构设计 Mac OS TCP/IP Excel Vim Windows Socket Oracle VR MongoDB Python 运营 MemCache 商业硬件电子娱乐设计 nginx 摄影游戏 WordPress HTTP 团建数码电器

php7 安装fileinfo扩展 preg_split — 通过一个正则表达式分隔字符串 php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题 [PHP] inet_pton/inet_ntop IP地址转换函数 array_multisort() 多字段排序 PHPMailer设置utf8 PHPMailer字符集CharSet ADORecordSet对象 adodb手册 PHP 8.1 [鸟哥]PHP_INT_MIN 和 -9223372036854775808 opcache预加载 Composer的Packagist资源 mysql面试题 [鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式 PHP7添加redis扩展 PHP mkdir()写出来的权限与mode值不符合 Packagist / Composer 中国全量镜像利用php soap实现web service PHP获取指定函数定义在哪个文件中及行号支持php7的性能采集扩展

略微加速

PHP官方手册 - 互联网笔记

get_magic_quotes_gpc

说明

返回值

更新日志

参见

User Contributed Notes 10 notes