magic_quotes on php 5.3 will not go away

Question

I have an Ubuntu 10.04 server, running PHP 5.3.2 and I have these lines set in my php.ini file:

magic_quotes_gpc = Off
magic_quotes_runtime = Off
magic_quotes_sybase = Off

There are NO other php.ini files (I searched the whole hard drive), I checked ALL apache2 configuration files (including ALL .htaccess files on the entire hard drive), and they are not referenced anywhere else.

However:

<?php
    ini_set('display_errors', 1);
    error_reporting(E_ALL);
    var_dump(get_magic_quotes_gpc());
?>

Produces this output: int(1) That is, the magic quotes are on, which is easily verifiable by adding any type of request with quotes, and they will be quoted out. I have fixed this by adding the following to my root .htaccess file:

php_flag magic_quotes_gpc Off

The aforementioned code now produces the desired result: int(0), and no output is quoted.

So the question: why, oh dear God why, were the magic quotes on in the first place?! Yes, I know this question is similar to others that have been asked. I'm not looking for a "quick fix", and yes, I know magic quotes will be removed in php 5.4. But the truth is, I will need to maintain backwards compatibility for a few years after 5.4 comes out (different clients, etc), and so I'm trying to figure out why magic quotes were on. I know I can fix this by adding a line to my root .htaccess file (as I've shown), but I would much rather have a greater understanding of how my php.ini setting was overridden in the first place.

So does anyone have any ideas on how it could have been turned on?

I've reset not only apache, but restarted the entire server (many times). A reset does not fix it. As for Debian/Ubuntu maintainers, how do they get around the apache and php configuration files? Are you saying this is something handled by the OS? If so, why does the .htaccess file get around it, and can you provide any proof this is what is happening? — cegfault, Mar 06 '12 at 09:25

score 1 · Answer 1 · answered Mar 08 '12 at 12:50

1

I had this same problem today, and found this question, but no apparent solution!

I finally solved the issue by also applying the magic_quotes_gpc = Off line in the last file in the /etc/php5/apache2/conf.d folder, so it seems something is overriding the original php.ini file, but applying the setting once more in the last included file actually turned magic_quotes back off again.

answered Mar 08 '12 at 12:50

adeneo

312,895
29
395
388

1

WOW, man thank you soooooooooooooooooooo much! That finally saved my life! Why, why is this stupid bug. And I searched through all... your solution is the only one! My HERO!!!! thx! – systrue May 29 '12 at 09:23

score 1 · Accepted Answer · answered Mar 16 '12 at 08:19

1

I finally figured it out; update apache2 and php5:

apt-get update
apt-get install apache2 php5

This is a bug with certain versions in apache2 and/or php5. The version in Debian's apt universe has been updated, so just updating will fix the problem.

answered Mar 16 '12 at 08:19

cegfault

6,442
3
27
49

score 0 · Answer 3 · answered Sep 05 '13 at 01:05

This worked for me:

I changed:

; Magic quotes
;


; Use Sybase-style magic quotes (escape ' with '' instead of \').
  magic_quotes_sybase = 0
  magic_quotes_gpc = 0
  magic_quotes_runtime = 0

to:

; Magic quotes
;


; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = 0
magic_quotes_gpc = 0
magic_quotes_runtime = 0

Had spaces before the settings, and wasted hours of time searching out every instance of magic_quotes, and every php.ini file or any .ini file at all.

(I did this in my .drush directory in drush.ini, but it will probably work in php.ini)

score 0 · Answer 4 · answered Mar 06 '12 at 07:05

0

At the top of it's output PHPinfo() tells you the actual php.ini file used.

There are NO other php.ini files (I searched the whole hard drive), I checked ALL apache2 configuration files (including ALL .htaccess files on the entire hard drive), and they are not referenced anywhere else.

There is no magic either.
If it's set - it is set somewhere.

answered Mar 06 '12 at 07:05

Your Common Sense

156,878
40
214
345

Loaded Configuration File: `/etc/php5/apache2/php.ini`, Scan this dir for additional .ini files: `/etc/php5/apache2/conf.d`, Additional .ini files parsed: `[......]` Checked them all. The **ONLY** place it is set is in the main `/etc/php5/apache2/php.ini` file, where I have set them to all to `off`. – cegfault Mar 06 '12 at 09:24
a wild guess: may be there are some includes in this file? or multiple lines with same setting? BTW, what does it say about master value? – Your Common Sense Mar 06 '12 at 09:39
No includes in the file, and no multiple lines with the same setting. As for the master value, that's interesting: The local value is showing up as `off`, but the master value as `on` -- does that mean the local value is being overridden? – cegfault Mar 06 '12 at 09:41
And where the hell is the mater value coming from? – cegfault Mar 06 '12 at 09:41
it actually reflects your setup: the master value (php.ini one) is on somehow, but local is overwritten in .htaccess – Your Common Sense Mar 06 '12 at 09:44
That makes sense, but where is the master value coming from? I'm telling you, the only place I can find it is in php.ini, and there I have it set to 'Off'. I don't know where else it could be. – cegfault Mar 06 '12 at 09:47

magic_quotes on php 5.3 will not go away

4 Answers4