magic_quotes off - can code break?

Question

If I turn off magic_quotes in an environment where I did not wrote the code, how can I check if any problems may occur? For what do I have to check? Which functions may not work any more?

If you're got code that requires magic_quotes to be on, then you should be updating the code. It won't run on PHP 5.4 anymore - magic_quotes has been deprecated a long time now, and PHP 5.4 finally removes it from the language entirely. — Marc B, Mar 07 '12 at 18:30

score 1 · Accepted Answer · edited Mar 11 '12 at 12:44

When magic_quotes turned on, Magic Quotes automatically performs an addslashes() on all form data submitted. It means that a [\] is placed before every ['], ["], [], or null in the data, so That's nice will be converted to That\'s nice automatically. This all happens before your coding even sees that data, so if you're just passing a string to the next page (not to database) it will print with slashes even though you may not want them at all.

score 0 · Answer 2 · answered Mar 07 '12 at 18:01

Unfortunately, I don't think there's an easy answer. You'll want to check for any place where you're working directly with user input. If the code is simple enough, you can search for uses of $_GET and $_POST, but without at least a scanning code review, you're unlikely to find everything that way.

One thing I've had break a lot when I turn it off is sql insert/update queries someone had written that contained request parameters they had not properly escaped.

score 0 · Answer 3 · answered Mar 07 '12 at 18:02

Magic quotes affects incoming data strings. Any place you use $_GET or $_POST or variables of that nature can be affected.

Basically, any place you accept data from the user.

Note: More importantly, you should look through all of your SQL queries and make sure that any input strings are escaped! Otherwise your code will be vulnerable to SQL injection.

magic_quotes off - can code break?

3 Answers3