解决魔术引号，或者只是确保它们关闭？
是否值得将我的代码更改为“更便携”并能够处理魔法引号的恐怖，或者我应该确保它始终通过 .htaccess 文件关闭？
if (get_magic_quotes_gpc()) {
$var = stripslashes($_POST['var']);
} else {
$var = $_POST['var'];
}
相对
php_flag magic_quotes_gpc off
Is it worth changing my code to be "more portable" and able to deal with the horror of magic quotes, or should I just make sure that it's always off via a .htaccess file?
if (get_magic_quotes_gpc()) {
$var = stripslashes($_POST['var']);
} else {
$var = $_POST['var'];
}
Versus
php_flag magic_quotes_gpc off
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不要同时适应这两种情况。 两条代码路径=两倍的麻烦，而且你很可能会犯错并忘记在某个地方处理这两种情况。
我曾经检查魔术引号是否打开或关闭，如果打开，则撤消它们的魔术（正如线程中其他人所建议的那样）。 这样做的问题是，您正在更改其他程序员可能期望的配置环境（无论多么愚蠢）。
这些天我编写代码，就好像魔术引号关闭一样，在我的主 include/bootstrap/always-runs 文件中，我检查魔术引号是否打开或关闭。 如果它们打开，我会抛出一个异常，解释为什么这是一件坏事，并提供如何关闭它们的说明。
这种方法允许您针对单一行为进行编码，鼓励其他人使用您的代码正确配置他们的服务器（魔术引号在 PHP 6 中消失），并且如果有人确实需要魔术引号，他们可以处理你的例外并把他们的生命掌握在自己手中。
Don't accommodate both situations. Two code paths = twice the headaches, plus there's a good chance you'll slip up and forget to handle both situations somewhere.
I used to check if magic quotes were on or off, and if they were on, undo their magic (as others in the thread have suggested). The problem with this is, you're changing the configured environment (no matter how stupid) that another programmer may expect.
These days I write code as though magic quotes are off, and in my main include/bootstrap/always-runs file I check if magic quotes are on or off. If they're on I throw an Exception that explains why this is a bad thing, and provide instructions on how they can be turned off.
This approach allows you to code to a single behavior, encourages other folks using your code to configure their servers correctly (magic quotes is going away in PHP 6), and if someone really needs magic quotes on they can handle your exception and take their lives into their own hands.
我会使用 get_magic_quotes_gpc() 检查设置并执行一个大噪音退出并出现错误。 在错误中通知管理员正确的设置。
I would check the setting using
get_magic_quotes_gpc()and do a big noisy exit with error. In the error inform the administrator of the proper setting.如果可能的话，我会确保它已关闭（需要访问 .htaccess 或 apache 配置）。 最好完全避免它，而不是剥离它的行为，因为它需要更多的资源并且容易出现错误。
如果禁用它不是一个选项，您的示例代码可能对输入超全局变量（$_GET、$_POST，...）有用，但请确保不要将其应用于来自除这些超全局变量以外的来源的数据。 这种滥用非常常见。
只需确保关闭 magic_quotes_gpc() 时有适当的转义机制来保护您免受 SQL 注入（例如 mysql_real_escape_string() 或 PDO 准备语句）。 您可以在此处阅读有关 SQL 注入预防的更多信息。
I would make sure it's off if that's possible (requires access to .htaccess or apache configuration). It's better to avoid it altogether than stripping it's behavior which requires more resources and is prone to bugs.
If disabling it is not an option, your example code could be useful for the input superglobals ($_GET,$_POST,...) but make sure not to apply it on data arriving from sources other than those supergloabls. Such misuse is pretty common.
Just make sure that when turning magic_quotes_gpc() off to have a proper escaping mechanism in place to protect you from SQL inkection (such as mysql_real_escape_string() or PDO prepared statements). You can read more on SQL injection prevention - here.
顺便说一句，php 6 将不再支持它们。 因此，写掉它们的代码可能在将来是有益的。
On more of a side note php 6 won't be supporting them anymore. So writting the code for them off may be beneficial in the future.