Everything

php

Adieu a la magie (remove magic_quotes)

php.internals

Pierre Joye

20 years ago

Hello,

As planed (and like register_globals earlier today), the magic_quotes
will be removed in php6. Here is a patch:

http://pear.php.net/~pierre/remove_magic_quotes.txt

It removes completely the following things:

ini settings removed:
. magic_quotes_gpc
. magic_quotes_runtime
. magic_quotes_sybase

functions removed:
. get_magic_quotes_gpc
. get_magic_quotes_runtime
. set_magic_quotes_runtime

Extenstion affected (tests only or tests and implementation):
ext/dba
ext/exif
ext/iconv
ext/mbstring
ext/mhash
ext/pcre
ext/pdo
ext/spl
ext/standard
ext/sysvsem
ext/xml

Comments and feedbacks welcome, I will commit on wednesday unless there
is objections or changes.

Cheers,

--Pierre

Pierre Joye

20 years ago

Hello,

Given the little objections in the other thread (about
register_globals), I like to commit this patch anyway.

If this discussion conclusion is to keep the faked functions and ini
entries, we can add them later.

My only problem is how to add E_CORE_ERROR in a nice way for the faked
ini entries...

But please review the patch, it is more important that adding these BC
horrible things :)


Regards,

--Pierre

Pierre Joye

20 years ago

On 3/7/06, Zeev Suraski <zeev@zend.com> wrote:

> The point is that breakage is aggregated, not binary.  The more stuff
> we break, the more difficult it is to port, and frankly, it's quite
> likely that a non OO app could migrate fairly cleanly even to PHP 6
> with unicode disabled (perhaps with minor
> fixes).  get_magic_quotes_gpc() is designed for apps to do something
> differently depending on the value of magic_quotes_gpc.  It's fine
> that it's always off in PHP 6, but there's no reason not to keep this
> function (to always return false) so that you don't have to fix God
> knows how many lines of code to remove it.

Fair enough, as I said in my last post in the magic_quotes thread, it
is easy to keep this function. I will modify the patch to keep the
related functions (returning always false). Is is ok?

Now about the ini entries, ini_get("removed_entry") will always return
0 (false), which is exactly the same as an entry set to off. Do we
really want a E_CORE_ERROR if they are still set to on or used?

--Pierre

Johannes Schlueter

20 years ago

Hi Pierre,

On Tuesday 07 March 2006 15:16, Pierre wrote:

> Fair enough, as I said in my last post in the magic_quotes thread, it
> is easy to keep this function. I will modify the patch to keep the
> related functions (returning always false). Is is ok?

I'd also mark them as deprecated using the new deprecation flag since new
applications shouldn't use it.

johannes

Pierre Joye

20 years ago

On 3/7/06, Pierre <pierre.php@gmail.com> wrote:

>
> On 3/7/06, Zeev Suraski <zeev@zend.com> wrote:
>
> > The point is that breakage is aggregated, not binary.  The more stuff
> > we break, the more difficult it is to port, and frankly, it's quite
> > likely that a non OO app could migrate fairly cleanly even to PHP 6
> > with unicode disabled (perhaps with minor
> > fixes).  get_magic_quotes_gpc() is designed for apps to do something
> > differently depending on the value of magic_quotes_gpc.  It's fine
> > that it's always off in PHP 6, but there's no reason not to keep this
> > function (to always return false) so that you don't have to fix God
> > knows how many lines of code to remove it.
>
> Fair enough, as I said in my last post in the magic_quotes thread, it
> is easy to keep this function. I will modify the patch to keep the
> related functions (returning always false). Is is ok?

The patch is now updated (same link). The functions are restored but
deprecated using the new ZEND_DEP_* macros.

set_magic_quotes_runtime raise a E_CORE_ERROR as described in the PDM.
The other always return false.

No more objection?

--Pierre

Pierre Joye

20 years ago

On Tue, 7 Mar 2006 16:22:08 +0100
pierre.php@gmail.com (Pierre) wrote:

> On 3/7/06, Pierre <pierre.php@gmail.com> wrote:
> >
> > On 3/7/06, Zeev Suraski <zeev@zend.com> wrote:
> >
> > > The point is that breakage is aggregated, not binary.  The more
> > > stuff we break, the more difficult it is to port, and frankly,
> > > it's quite likely that a non OO app could migrate fairly cleanly
> > > even to PHP 6 with unicode disabled (perhaps with minor
> > > fixes).  get_magic_quotes_gpc() is designed for apps to do
> > > something differently depending on the value of
> > > magic_quotes_gpc.  It's fine that it's always off in PHP 6, but
> > > there's no reason not to keep this function (to always return
> > > false) so that you don't have to fix God knows how many lines of
> > > code to remove it.
> >
> > Fair enough, as I said in my last post in the magic_quotes thread,
> > it is easy to keep this function. I will modify the patch to keep
> > the related functions (returning always false). Is is ok?
>
> The patch is now updated (same link). The functions are restored but
> deprecated using the new ZEND_DEP_* macros.
>
> set_magic_quotes_runtime raise a E_CORE_ERROR as described in the PDM.
> The other always return false.
>
> No more objection?

Done, as Zeev said, the functions are kept and return false, except for
set_magic_quotes_runtime which raises a core error. They are declared
using the depracated flag.

--Pierre