Magic Quotes Problem

[blinkbob123]

Hi, I wish to use magic quotes but it has been disabled on my server. I'm not too great with arrays but tried putting:

code:------------------------------------------------------$global = @array(0 => $_GET, 1 => $_POST, 2 => $_ENV, 3=> $_COOKIE, 4=> $_SESSION, 5 => $_SERVER, 6 => $_FILES);

if(!get_magic_quotes_gpc()) {
foreach($global as $key => $val) {
$global[$key] = addslashes($val);
}
}
-----------------------------------------------------------

in a header file on my website. But it did not work. Is this the correct/secure way to do it and if so how do I fix it. Thanks

 

[sleipnir214]

As far as your posted code goes:
In your foreach, $val is going to be an array, not a singleton value. You can't pass an array to addslashes().

Also, the array your code should reference is $GLOBALS, not $global. PHP arrays are case-specific, and you will want to reference the actual superglobal, not a local variable.


However:
Dumping all values into $GLOBAL is the same thing as configuring PHP with register_globals set to "on". As the [link

http://us2.php.net/manual/en/security.globals.php

]PHP online manual entry titled "Using Register Globals"[/url], setting register_globals to "on" is a bad thing.

I strongly recommend that you just apply addslashes() or mysql_escape_string() or whathaveyou as you use each variable.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[blinkbob123]

Hi cheers, I want to make sure my script works on a server which has magic quotes enable or disabled. Will the following work fine if I use the function fixslashes on any variables which will be used in a mysql insert statement. Cheers

$test = fixslashes($_POST['test'])

function fixslashes($var) {
if(!get_magic_quotes_gpc()) {
$var = addslashes($var);
}

return $var
}

 

[kenrbnsn]

How about:

function fixslashes($str)
{
   return (addslashes(stripslashes($str));
}

If magic quotes are disabled, the stripslashes function doesn't do anything. If magic quotes are turned on, it does it's work. Then the addslashes function does it's work no matter what.

Ken