phpmagentomagic-quotes-gpc

Quotes being escaped when magic_quotes_gpc is set to off


Magento is escaping apostrophes when magic_quotes_gpc is set to off. When I set magic_quotes_gpc to on, Magento stops inserting slashes. It's completely backwards.

I can't have Magento escaping my apostrophes, but I also do not want to have magic_quotes_gpc set to on because I am concerned about the implications it might have on other parts of my site (vBulletin forum, Wordpress blog, etc.).

Just to note - Magento wasn't always behaving this way, it only started today.

EDIT: The behavior started after adding the following code to the Layout Update XML of one of my CMS pages:

<!--<reference name="content">
<block type="catalog/product_new" name="home.catalog.product.new" alias="product_new" template="catalog/product/new.phtml" after="cms_page"><action method="addPriceBlockType"><type>bundle</type><block>bundle/catalog_product_price</block><template>bundle/catalog/product/price.phtml</template></action></block>
<block type="reports/product_viewed" name="home.reports.product.viewed" alias="product_viewed" template="reports/home_product_viewed.phtml" after="product_new"><action method="addPriceBlockType"><type>bundle</type><block>bundle/catalog_product_price</block><template>bundle/catalog/product/price.phtml</template></action></block>
<block type="reports/product_compared" name="home.reports.product.compared" template="reports/home_product_compared.phtml" after="product_viewed"><action method="addPriceBlockType"><type>bundle</type><block>bundle/catalog_product_price</block><template>bundle/catalog/product/price.phtml</template></action></block>
</reference>
<reference name="right">
<action method="unsetChild"><alias>right.reports.product.viewed</alias></action>
<action method="unsetChild"><alias>right.reports.product.compared</alias></action>
</reference>-->

After the weird behavior started, I removed that code, but it did not fix the problem.


Solution

  • EDIT: I figured out the problem. It turns out that Wordpress has it's own function to add in slashes. As of Wordpress version 3.2.1, you can find function wp_magic_quotes() around line 530 of /wp-includes/load.php

    To fix the issue, I commented out everything within the function (not the function itself, so as to prevent a call to an undefined function). It's removed the issue of escaped quotes. I haven't done extensive testing, but from what I understand, this may break older Wordpress plug-ins, so be careful.

    It will go from this:

    function wp_magic_quotes() {
        // If already slashed, strip.
        if ( get_magic_quotes_gpc() ) {
            $_GET    = stripslashes_deep( $_GET    );
            $_POST   = stripslashes_deep( $_POST   );
            $_COOKIE = stripslashes_deep( $_COOKIE );
        }
    
        // Escape with wpdb.
        $_GET    = add_magic_quotes( $_GET    );
        $_POST   = add_magic_quotes( $_POST   );
        $_COOKIE = add_magic_quotes( $_COOKIE );
        $_SERVER = add_magic_quotes( $_SERVER );
    
        // Force REQUEST to be GET + POST.
        $_REQUEST = array_merge( $_GET, $_POST );
    }
    

    to this:

    function wp_magic_quotes() {
        // If already slashed, strip.
        /*if ( get_magic_quotes_gpc() ) {
            $_GET    = stripslashes_deep( $_GET    );
            $_POST   = stripslashes_deep( $_POST   );
            $_COOKIE = stripslashes_deep( $_COOKIE );
        }
    
        // Escape with wpdb.
        $_GET    = add_magic_quotes( $_GET    );
        $_POST   = add_magic_quotes( $_POST   );
        $_COOKIE = add_magic_quotes( $_COOKIE );
        $_SERVER = add_magic_quotes( $_SERVER );
    
        // Force REQUEST to be GET + POST.
        $_REQUEST = array_merge( $_GET, $_POST );*/
    }