Request for Comments: Magic Quotes in PHP, the Finalé

• Version: 1.0
• Date: 2011-07-18
• Author: Daniel Convissor danielc@php.net
• Status: Withdrawn
• First Published at: https://wiki.php.net/rfc/magicquotes_finale
• Extends: https://wiki.php.net/rfc/magicquotes
• Supersedes: https://wiki.php.net/todo/php54

Magic Quotes needs to be done away with. This needs to be done in a safe, orderly manner.

1) Magic Quotes are already off. While they are set to off in our distributed php.ini files, they are on by default in PHP itself.

2) Magic Quotes already raise an E_DEPRECATED message. The message is only raised when explicitly setting “magic_quotes_* = On.” People on systems using PHP's default values do not get any warning about Magic Quotes being deprecated.

3) Magic Quotes isn't a safety feature. Yes, administrators and programmers relying on this feature are misguided. None the less, there are people (unknowingly) relying on this behavior to escape their SQL statements. Turning it off by default without explicitly warning users via the language itself will open security holes.

• Raise E_DEPRECATED when running the CGI or any web server SAPI and a php.ini file does not contain “magic_quotes_gpc = Off”.
• PHP's default value for magic_quotes_gpc remains as on.

• Raise E_ERROR when running the CGI or any web server SAPI and a php.ini file does not contain “magic_quotes_gpc = Off”.
• Set PHP's default value for magic_quotes_gpc to off.

“removal” What do people think should happen here? Please discuss.

• Internals: "Magic quotes in trunk", 2010-11-17.

• 1.0: Initial version (2011-07-18)
• Declined as we ended up removing in 5.4 per http://www.mail-archive.com/internals@lists.php.net/msg52203.html