Magic quotes

Magic quotes was a controversial feature of the PHP scripting language, wherein strings are automatically escapedspecial characters are prefixed with a backslashbefore being passed on. It was introduced to help newcomers write functioning SQL commands without requiring manual escaping. It was later described and widely misinterpreted as intended to prevent inexperienced developers from writing code that was vulnerable to SQL injection attacks.

This feature was officially deprecated as of PHP 5.3.0 and removed in PHP 5.4, due to security concerns.[1]

Concept

The current revision of the PHP manual mentions that the rationale behind magic quotes was to "help [prevent] code written by beginners from being dangerous."[2] It was however originally introduced in PHP 2 as a php.h compile-time setting for msql, only escaping single quotes, "making it easier to pass form data directly to msql queries".[3] It originally was intended as a "convenience feature, not as [a] security feature."[4][5]

The use scope for magic quotes was expanded in PHP 3. Single quotes, double quotes, backslashes and null characters in all user-supplied data all have a backslash prepended to them before being passed to the script in the $_GET, $_REQUEST, $_POST and $_COOKIE global variables. Developers can then in theory use string concatenation to construct safe SQL queries with data provided by the user. (This was most accurate when PHP 2 and PHP 3 were current, since the primary supported databases allowed only 1-byte character sets.)

Criticism

Magic quotes were enabled by default in new installations of PHP 3 and 4, but could be disabled through the magic_quotes_gpc configuration directive. Since the operation of magic quotes was behind the scenes and not immediately obvious, developers may have been unaware of their existence and the potential problems that they could introduce. The PHP documentation pointed out several pitfalls and recommended that, despite being enabled by default, they should be disabled.[6]

Problems with magic quotes included:

In November 2005 the core PHP developers decided that because of these problems, the magic quotes feature would be removed from PHP 6.[10] When development of PHP 6 stalled and development continued on the 5.x branch instead, the feature was deprecated in PHP 5.3.0 and removed in 5.4.[1]

Other approaches

See also

References

  1. 1 2 "Magic Quotes". PHP Manual. PHP.net. Retrieved 2014-01-17.
  2. "PHP:Why use magic quotes?". PHP documentation. Retrieved 2007-02-19.
  3. "If the MAGIC_QUOTES variable is defined in the php.h file then these quotes will be automatically escaped making it easier to pass form data directly to msql queries.". Retrieved 1997-04-23. Check date values in: |access-date= (help)
  4. "Magic Quotes is oft-understood, even by journeymen PHP programmers".
  5. "Re: [PHP3] what are magic_quotes?". PHP-dev mailing list. Retrieved 1999-08-27. Check date values in: |access-date= (help)
  6. "PHP:Why not to use magic quotes". PHP documentation. Retrieved 2007-02-19.
  7. "Quotation marks are double escaped when editing a comment". WordPress issue tracker. Retrieved 2007-02-19.
  8. Chris Shiflett. "addslashes() versus mysql_real_escape_string()". Retrieved 2007-02-19.
  9. MySQL AB. "Changes in release 5.0.22 (24 May 2006)". MySQL 5.0 Reference Manual. Retrieved 2007-02-19.
  10. PHP Group (2005-11-12). "Minutes PHP Developers Meeting". Retrieved 2007-02-19.
  11. Dan Ragle (2006-04-18). "Introduction to Perl's Taint Mode". webreference.com. Retrieved 2007-03-21.
  12. "Locking Ruby in the Safe". Programming Ruby. Archived from the original on 2009-05-30. Retrieved 2014-05-21.
  13. Joel Spolsky (2005-05-11). "Making Wrong Code Look Wrong". Joel on Software: Painless Software Management. Retrieved 2007-02-19.

External links

This article is issued from Wikipedia - version of the 9/9/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.