Disabling magic_quotes_gpc for the panel

[aseques]

Hi, I'm using fastcgi with a debian install, and there's a problem when installing roundcube.
The problem is that the default configuration is forcing magic_quotes_gpc = On
This is considered a bad behavior by the php team and is to be removed in the coming version 6

To disable it for the control panel you just have to go and edit the file /var/www/fcgi/master/php5/php.ini
In there you have to change the value to Off, reload your apache and everything will be working.

Since it's not recommended to use it, wouldn't be more interesting to keep it off by default and turn it on in case it's necessary?

[Cube]

What can happen with magic_quotes_gpc = On and Roundcube? I have not changed this and until now have not experienced any problems.

[momo]

They suggest to no rely on it since it will be deprecated and removed in php6. I turned it off for roundcube and haven't remark anything wrong with ispcp. I think the dev team decided to keep using it since we are not using php6 yet.

Something wrong with turning this off? Advice?

[aseques]

I've had had it for some days turned off, and everything is working fine with the control panel
The cons of using it, are:
"When magic_quotes are on, all ' (single-quote), " (double quote), \ (backslash) and NUL's are escaped with a backslash automatically. "

So, if you're using htmlspecialchars() or addslashes(), things might get double escaped, getting "test" saved as \\"test\\"

More information on http://es.php.net/manual/en/info.configu...quotes-gpc

[tomdooley]

Some parts of the order panel have to be rewritten to work either with magic_quotes on or off. Warning from php.net:

Code:

This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged.

Does anyone have a different meaning?

[pgentoo]

If it is deprecated, we should ideally update all of our core ispcp code to work without it, and switch the master/php5/php.ini to have it off.

Doing this for the user domains could be a pain though, as there is a lot of code out there requiring it. I don't think we can do this without providing some basic php.ini editing via the control panel (as discussed in other threads). If the user has the ability to toggle it on/off, then I don't think its as much of a problem changing the default, but without that all our admins will get a flood of support calls...

-
pgentoo