php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #30527 magic_quotes_gpc does not work per-directory
Submitted: 2004-10-22 11:43 UTC Modified: 2005-06-13 11:18 UTC
Votes:6
Avg. Score:5.0 ± 0.0
Reproduced:6 of 6 (100.0%)
Same Version:3 (50.0%)
Same OS:5 (83.3%)
From: andrew at crannog-software dot com Assigned:
Status: Closed Package: PHP options/info functions
PHP Version: 4.3.9 OS: Windows 2000
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: andrew at crannog-software dot com
New email:
PHP Version: OS:

 

 [2004-10-22 11:43 UTC] andrew at crannog-software dot com 
Description:
------------
When magic_quotes_gpc is controlled per-directory through the registry, the return code from get_magic_quotes_gpc() reflects the change, but the contents of $_GET, $_POST and $_COOKIE remain escaped or not escaped according to the setting in php.ini.

The code below was run with magic_quotes_gpc=on in php.ini and magic_quotes_gpc="0" in the registry for the folder in which the script resides.

Reproduce code:
---------------
<html>
 <body>
  magic_quotes_gpc is <?php echo get_magic_quotes_gpc() ? "on" : "off"; ?><br />
  text: <?php echo $_REQUEST['text']; ?><br />
  <form action="test.php">
   <input name="text" />&nbsp;<input type="submit" />
  </form>
 </body>
</html>

Expected result:
----------------
magic_quotes_gpc is off
text: "test"

Actual result:
--------------
magic_quotes_gpc is off
text: \"test\"

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-11-21 18:42 UTC] hans at velum dot net 
I can confirm this on Windows 2003 w/ IIS 6 also.  Note that the magic_quotes_sybase INI setting is also being ignored.  Basically it's always doing magic_quotes_gpc -- despite the phpinfo() / ini_get showing the desired per-directory values.
 [2004-11-24 00:47 UTC] sniper@php.net 
Using PHP as CGI binary or ISAPI module?
 [2004-11-24 16:23 UTC] sniper@php.net 
See also bug #30813
 [2004-11-29 19:23 UTC] hans at velum dot net 
For me the issue appears when using PHP as ISAPI module w/ IIS.
 [2004-12-02 09:42 UTC] andrew at crannog-software dot com 
The problem occurs when using PHP as an ISAPI module.
 [2005-02-03 04:47 UTC] sniper@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
 [2005-06-11 04:21 UTC] hans at velum dot net 
This bug is still happening as of 4.3.11 and is a pretty serious impediment to deploying complex PHP applications in IIS.
 [2005-06-13 11:03 UTC] andrew at crannog-software dot com 
Sorry about the lack of feedback - since I got the problem applications working together with a small amount of editing code I can't justify reinstalling PHP.
 [2005-06-13 11:18 UTC] sniper@php.net 
Assumed fixed. (the bug #30813 is fixed)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Mar 14 15:01:30 2025 UTC