Edit report at https://bugs.php.net/bug.php?id=62526&edit=1
ID: 62526 Updated by: ras...@php.net Reported by: sun at unleashedmind dot com Summary: magic_quotes_gpc is deprecated but defaults to 1 -Status: Open +Status: Not a bug Type: Bug Package: PHP options/info functions PHP Version: 5.3.14 Block user comment: N Private report: N New Comment: Because it does unfortunately provide a security blanket for a number of sites out there. So we warn that it is deprecated and focus on trying to teach people to turn it off and not use it in 5.3 before we entirely remove it in 5.4. Previous Comments: ------------------------------------------------------------------------ [2012-07-11 01:42:59] sun at unleashedmind dot com Description: ------------ http://php.net/manual/info.configuration.php states: Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. But yet: Name Default [...] Changelog magic_quotes_gpc "1" Removed in PHP 5.4.0. Pretty much all distros ship with PHP 5.3.x that has it disabled today: magic_quotes_gpc = Off But when PHP has no configuration file (which happens to be the case for CLI in some bundles/distros; e.g., MAMP), then the evil feature is unexpectedly enabled. Proposed solution: - Change the default to "0" (off). Related bugs: - https://bugs.php.net/bug.php?id=61550 - philip stated that "It remains on by default with PHP 5.3.x", but did not give a reason for why that is. Any chance to discuss, or at least to get a reason? Backstory: http://drupal.org/node/1569456#comment-6045228 Test script: --------------- echo ini_get("magic_quotes_gpc"); Expected result: ---------------- 0 Actual result: -------------- 1 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62526&edit=1
