章 31. 魔术引号

目录
什么是魔术引号
为什么要用魔术引号
为什么不用魔术引号
关闭魔术引号

魔术引号（Magic Quote）是一个自动将进入 PHP 脚本的数据进行转义的过程。最好在编码时不要转义而在运行时根据需要而转义。

什么是魔术引号

当打开时，所有的 '（单引号），"（双引号），\（反斜线）和 NULL 字符都会被自动加上一个反斜线进行转义。这和 addslashes() 作用完全相同。

一共有三个魔术引号指令：

magic_quotes_gpc
影响到 HTTP 请求数据（GET，POST 和 COOKIE）。不能在运行时改变。在 PHP 中默认值为 on。
参见 get_magic_quotes_gpc()。
magic_quotes_runtime
如果打开的话，大部份从外部来源取得数据并返回的函数，包括从数据库和文本文件，所返回的数据都会被反斜线转义。该选项可在运行的时改变，在 PHP 中的默认值为 off。
参见 set_magic_quotes_runtime() 和 get_magic_quotes_runtime()。
magic_quotes_sybase
如果打开的话，将会使用单引号对单引号进行转义而非反斜线。此选项会完全覆盖 magic_quotes_gpc。如果同时打开两个选项的话，单引号将会被转义成 ''。而双引号、反斜线和 NULL 字符将不会进行转义。
如何取得其值参见 ini_get()。

add a note User Contributed Notes

judas dot iscariote at gmail dot com
08-Mar-2006 03:33


Just for the record. this feature has been removed as of PHP6.

now PHP works always like if magic_quotes_gpc Off.



get_magic_quotes_gpc, get_magic_quotes_runtime are kept but always return false, set_magic_quotes_runtime raises an E_CORE_ERROR.



this is great news, magic_quotes were a big annoyance.

27-Feb-2006 07:11


Using the .htaccess file may not always be possible for instance if you are running php on a windows IIS server.



Also the code by jfrim at idirect dot com doesn't actually fix the problem as it is stripping slashes, what you need to do is addslashes to things coming in.



the code by jfrim at idirect dot com is the right idea though although rather than saying stripslashes, you simply need to say addslashes and it should work.

edward at example dot com
07-Feb-2006 08:55


All the code listed on this page is not necessary if you use the php_flag directive in a .htaccess file. This allows you to disable magic quotes completely, without the need to adjust your php.ini file or (re)process the user's input.



Just take a look at http://www.php.net/manual/en/security.magicquotes.php#55935



Gist of his note: in the .htaccess file, add a line



php_flag magic_quotes_gpc off



That's it. Thank you very much, richard dot spindler :) !

jfrim at idirect dot com
28-Jan-2006 02:31


Unfortunately magic_quotes_gpc can not be changed at run-time, but here's a code block which will effectively get rid of it when executed.  Use this for PHP scripts which must be portable or run on servers where magic_quotes_gpc could be configured either way.



Note that the PHP help is a little misleading...  Magic_quotes_gpc affects more than just the Get, Post, and Cookie data!



<?php

//Prevent Magic Quotes from affecting scripts, regardless of server settings



//Make sure when reading file data,

//PHP doesn't "magically" mangle backslashes!

set_magic_quotes_runtime(FALSE);



if (get_magic_quotes_gpc()) {

    /*

    All these global variables are slash-encoded by default,

    because    magic_quotes_gpc is set by default!

    (And magic_quotes_gpc affects more than just $_GET, $_POST, and $_COOKIE)

    */

    $_SERVER = stripslashes_array($_SERVER);

    $_GET = stripslashes_array($_GET);

    $_POST = stripslashes_array($_POST);

    $_COOKIE = stripslashes_array($_COOKIE);

    $_FILES = stripslashes_array($_FILES);

    $_ENV = stripslashes_array($_ENV);

    $_REQUEST = stripslashes_array($_REQUEST);

    $HTTP_SERVER_VARS = stripslashes_array($HTTP_SERVER_VARS);

    $HTTP_GET_VARS = stripslashes_array($HTTP_GET_VARS);

    $HTTP_POST_VARS = stripslashes_array($HTTP_POST_VARS);

    $HTTP_COOKIE_VARS = stripslashes_array($HTTP_COOKIE_VARS);

    $HTTP_POST_FILES = stripslashes_array($HTTP_POST_FILES);

    $HTTP_ENV_VARS = stripslashes_array($HTTP_ENV_VARS);

    if (isset($_SESSION)) {    #These are unconfirmed (?)

        $_SESSION = stripslashes_array($_SESSION, '');

        $HTTP_SESSION_VARS = stripslashes_array($HTTP_SESSION_VARS, '');

    }

    /*

    The $GLOBALS array is also slash-encoded, but when all the above are

    changed, $GLOBALS is updated to reflect those changes.  (Therefore

    $GLOBALS should never be modified directly).  $GLOBALS also contains

    infinite recursion, so it's dangerous...

    */

}



function stripslashes_array($data) {

    if (is_array($data)){

        foreach ($data as $key => $value){

            $data[$key] = stripslashes_array($value);

        }

        return $data;

    }else{

        return stripslashes($data);

    }

}

?>

07-Dec-2005 10:09


You should try to avoid magic_quotes in all its flavors, use add_slashes() and strip_slashes() instead with user input and you will save time and avoid common problems that come along.



You should know also that if your server has php suexec enabled you won't be able use php_flag in .htaccess file to change php values like magic_quotes or register_globals. In this case you might wanna try creating a php.ini file on the same directory as your script and add something like this:



magic_quotes_runtime=off

magic_quotes_gpc=off

magic_quotes_sybase=off

register_globals=on ; only as an example



----

Mel

http://www.webhostingjournal.net/

richard dot spindler at gmail dot com
18-Aug-2005 04:59


to turn of magic quotes put the following line into the .htaccess file:



php_flag magic_quotes_gpc off

17-Jul-2005 10:44


Bright minds will have noticed, that one uses stripslashes() once on the input and saves that content for further processing. Then use addslashes() once before sending the content to the database or flat file.



Hint: if the application is using a MySql database, don't use addslashes() but mysql_real_escape_string().

nitrous at fuckoff dot com
27-Jan-2005 03:01


This "feature" is the cause of so many escaping problems.  It's very important to understand the implications of what magic quotes really do.



Nearly every call, except those being written directly to the database, using user submitted data will require a call to strip_slashes.  It gets very ugly very fast.



What should be done is proper escaping of shell parameters and database parameters. PHP provides several escaping functions intended for this purpose. Slashes alone don't cut it anyway.

add a note