phpmagic-quotes-gpc

Which superglobals are affected by magic_quotes_gpc = 1?


By looking at the name of this directive one may think that magic_quotes are only applied to $_GET, $_POST and $_COOKIE superglobals but there is one perturbing comment on the PHP Manual:

Please note, that when magic_quotes_gpc is set not only $_POST, $_GET, $_REQUEST, $_COOKIE arrays values are slashed. Actually every string value in $GLOBALS array is slashed, ie. $GLOBALS['_SERVER']['PATH_INFO'] (or $_SERVER['PATH_INFO']).

Can anyone confirm that this is true? Are the superglobals $GLOBALS, $_SERVER, $_FILES, $_SESSION and $_ENV affected as well?

One more question, if I iterate stripslashes() over the $_GET, $_POST and $_COOKIE arrays do I also need to iterate through the $_REQUEST array? Or are the changes automatically reflected?


Solution

  • I've run some tests on LightTPD 1.4.20 and PHP 5.3.0 with magic_quotes_gpc = On and $_SERVER wasn't altered (at least [SERVER_NAME] => local'host didn't). $_SESSION also isn't affected by magic_quotes.

    $_GET, $_POST, $_COOKIE and $_REQUEST were affected (and their $GLOBALS counterparts).

    Also, the changes in the GPC superglobals aren't automatically reflected in $_REQUEST.

    As for the $_FILES and $_ENV superglobals I'm not able to test them ATM.


    I've finally ran this test and, to my surprise, both $_FILES and php://input are affected.