php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #30527 magic_quotes_gpc does not work per-directory
Submitted: 2004-10-22 11:43 UTC Modified: 2005-06-13 11:18 UTC
Votes:6
Avg. Score:5.0 ± 0.0
Reproduced:6 of 6 (100.0%)
Same Version:3 (50.0%)
Same OS:5 (83.3%)
From: andrew at crannog-software dot com Assigned:
Status: Closed Package: PHP options/info functions
PHP Version: 4.3.9 OS: Windows 2000
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: andrew at crannog-software dot com
New email:
PHP Version: OS:

 

 [2004-10-22 11:43 UTC] andrew at crannog-software dot com 
Description:
------------
When magic_quotes_gpc is controlled per-directory through the registry, the return code from get_magic_quotes_gpc() reflects the change, but the contents of $_GET, $_POST and $_COOKIE remain escaped or not escaped according to the setting in php.ini.

The code below was run with magic_quotes_gpc=on in php.ini and magic_quotes_gpc="0" in the registry for the folder in which the script resides.

Reproduce code:
---------------
<html>
 <body>
  magic_quotes_gpc is <?php echo get_magic_quotes_gpc() ? "on" : "off"; ?><br />
  text: <?php echo $_REQUEST['text']; ?><br />
  <form action="test.php">
   <input name="text" />&nbsp;<input type="submit" />
  </form>
 </body>
</html>

Expected result:
----------------
magic_quotes_gpc is off
text: "test"

Actual result:
--------------
magic_quotes_gpc is off
text: \"test\"

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-11-21 18:42 UTC] hans at velum dot net 
I can confirm this on Windows 2003 w/ IIS 6 also.  Note that the magic_quotes_sybase INI setting is also being ignored.  Basically it's always doing magic_quotes_gpc -- despite the phpinfo() / ini_get showing the desired per-directory values.
 [2004-11-24 00:47 UTC] sniper@php.net 
Using PHP as CGI binary or ISAPI module?
 [2004-11-24 16:23 UTC] sniper@php.net 
See also bug #30813
 [2004-11-29 19:23 UTC] hans at velum dot net 
For me the issue appears when using PHP as ISAPI module w/ IIS.
 [2004-12-02 09:42 UTC] andrew at crannog-software dot com 
The problem occurs when using PHP as an ISAPI module.
 [2005-02-03 04:47 UTC] sniper@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
 [2005-06-11 04:21 UTC] hans at velum dot net 
This bug is still happening as of 4.3.11 and is a pretty serious impediment to deploying complex PHP applications in IIS.
 [2005-06-13 11:03 UTC] andrew at crannog-software dot com 
Sorry about the lack of feedback - since I got the problem applications working together with a small amount of editing code I can't justify reinstalling PHP.
 [2005-06-13 11:18 UTC] sniper@php.net 
Assumed fixed. (the bug #30813 is fixed)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Mar 14 15:01:30 2025 UTC