magic_quotes_gpc = 1 影响哪些超全局变量？
通过查看该指令的名称，人们可能会认为 magic_quotes 仅适用于 $_GET、$_POST 和 $_COOKIE< /code> 超全局变量，但有一个一个令人不安的评论PHP手册上：
请注意，当
magic_quotes_gpc不仅设置$_POST、$_GET、$_REQUEST、$_COOKIE数组值被削减。实际上$GLOBALS数组中的每个字符串值 被削减，即。$GLOBALS['_SERVER']['PATH_INFO']（或$_SERVER['PATH_INFO']）。
谁能证实这是真的吗？超全局变量是 $GLOBALS、$_SERVER、$_FILES、$_SESSION 和 $_ENV 也受到影响吗？
还有一个问题，如果我在 $_GET、$_POST 和 $_COOKIE 数组上迭代 stripslashes() ，我还需要迭代 $_REQUEST 数组？或者更改会自动反映吗？
By looking at the name of this directive one may think that magic_quotes are only applied to $_GET, $_POST and $_COOKIE superglobals but there is one perturbing comment on the PHP Manual:
Please note, that when
magic_quotes_gpcis set not only$_POST,$_GET,$_REQUEST,$_COOKIE
arrays values are slashed. Actually
every string value in$GLOBALSarray
is slashed, ie.$GLOBALS['_SERVER']['PATH_INFO'](or$_SERVER['PATH_INFO']).
Can anyone confirm that this is true? Are the superglobals $GLOBALS, $_SERVER, $_FILES, $_SESSION and $_ENV affected as well?
One more question, if I iterate stripslashes() over the $_GET, $_POST and $_COOKIE arrays do I also need to iterate through the $_REQUEST array? Or are the changes automatically reflected?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不管怎样，我建议你不要依赖GPC，因为它在较新的PHP版本中已被弃用...
它可能与你的问题不太相关，但在提出的SQL安全替代方案问题上，我通常使用准备好的语句+ mysql_real_escape_string MySQL。
为了使其接近完美，它涉及几个函数，因为它还应该支持整数、布尔值和空值，但您可以查看 NaturePhp .
Either way i'd advise you not to rely on GPC as it has been deprecated on newer PHP versions...
It may not be too relevant for your question but on the raised issue of SQL security alternatives i usually use prepared statements + mysql_real_escape_string for MySQL.
To make it close to perfect it involves a couple of functions as it also should support integer, boolean and null values but you can take a look at the source code on the Database and Database_mysql classes on NaturePhp .
我已使用
magic_quotes_gpc = On和$_SERVER在LightTPD 1.4.20和PHP 5.3.0上运行了一些测试> 没有改变（至少[SERVER_NAME] => local'host没有改变）。$_SESSION也不受 magic_quotes 的影响。$_GET、$_POST、$_COOKIE和$_REQUEST受到影响（及其$GLOBALS< /code> 对应）。此外，
GPC超全局变量中的更改不会自动反映在$_REQUEST中。至于
$_FILES和$_ENV超全局变量，我无法在 ATM 上测试它们。我终于运行了这个测试，令我惊讶的是，
$_FILES和php://input都受到影响。I've run some tests on
LightTPD 1.4.20andPHP 5.3.0withmagic_quotes_gpc = Onand$_SERVERwasn't altered (at least[SERVER_NAME] => local'hostdidn't).$_SESSIONalso isn't affected by magic_quotes.$_GET,$_POST,$_COOKIEand$_REQUESTwere affected (and their$GLOBALScounterparts).Also, the changes in the
GPCsuperglobals aren't automatically reflected in$_REQUEST.As for the
$_FILESand$_ENVsuperglobals I'm not able to test them ATM.I've finally ran this test and, to my surprise, both
$_FILESandphp://inputare affected.