PHP Programming Language - Cultural View

Magic quotes 113
Magic quotes
Magic quotes is a controversial feature of the PHP scripting language, intended to help prevent inexperienced
developers from writing code which is vulnerable to SQL injection attacks. This feature is officially deprecated as of
PHP 5.3.0, and removed in PHP 6 due to security concerns. [1]
Concept
The rationale behind magic quotes is to "help [prevent] code written by beginners from being dangerous." [2] Single
quotes, double quotes, backslashes and null characters in all user-supplied data all have a backslash prepended to
them before being passed to the script in the $_GET, $_REQUEST, $_POST and $_COOKIE global variables.
Developers can then in theory use string concatenation safely to construct SQL queries with data provided by the
user.
Criticism
Magic quotes were enabled by default in new installations of PHP3 and 4, and since their operation is behind the
scenes and not immediately obvious, developers may be unaware of their existence and the potential problems that
they can introduce. The PHP documentation points out several pitfalls and recommends that, despite being enabled
by default, they should be disabled. [3]
Problems with magic quotes include:
• Not all data that are supplied by the user are intended for insertion into a database. They may be rendered directly
to the screen, stored in a session, or previewed before saving. This can result in backslashes being added where
they are not wanted and being shown to the end user. This bug often creeps into even widely used software. [4]
• Not all data that are supplied by the user and used in a database query are obtained directly from sources protected
by magic quotes. For instance, a user-supplied value might be inserted into a database — protected by magic
quotes — and later retrieved from the database and used in a subsequent database operation. The latter use is not
protected by magic quotes, and a naive programmer used to relying on them may be unaware of the need to
protect it explicitly.
• Magic quotes also use the generic functionality provided by PHP's addslashes() function, which is not Unicode
aware and still subject to SQL injection vulnerabilities in some multi-byte character encodings. Database-specific
functions such as mysql_real_escape_string() or, where possible, prepared queries with bound parameters are
[5] [6]
preferred.
• While many DBMS support escaping quotes with a backslash, the standard actually calls for using another quote.
Magic quotes offer no protection for databases not set up to support escaping quotes with a backslash.
• Portability is an issue if an application is coded with the assumption that magic quotes are enabled and is then
moved to a server where they are disabled, or the other way round.
• Adding magic quotes and subsequently removing them where appropriate incurs a small but unnecessary
performance overhead.
• Magic quotes do not protect against other common security vulnerabilities such as cross-site scripting attacks or
SMTP header injection attacks.
In November 2005 the core PHP developers decided on account of these problems that the magic quotes feature
would be removed from PHP 6. [7]