The "magic_quotes_sybase" Problem

[summerblue]

Post A Post, titled (in the double quote) : "Charlie's little cat"

It will become (in the double quote) : "Charlie''s little cat"

Notice that, single quote become double quotes!!

YES , My 'magic_quotes_gpc' and 'magic_quotes_sybase' are enabled!

Here is The PHP.NET links: ​http://php.net/manual/en/security.magicquotes.disabling.php

[ryan]

Related: r18549

[summerblue]

Here is the solution :

Remove the line below, it's in the "wp-settings.php" Line 33. It's in the wrong position!

@ini_set( 'magic_quotes_sybase', 0 );

And then, in the "wp-includes/load.php", in The function "wp_magic_quotes()" add the code below, immediately after "if ( get_magic_quotes_gpc() ) {}"

function wp_magic_quotes() {
	// If already slashed, strip.
	if ( get_magic_quotes_gpc() ) {
		$_GET    = stripslashes_deep( $_GET    );
		$_POST   = stripslashes_deep( $_POST   );
		$_COOKIE = stripslashes_deep( $_COOKIE );
	}

	// Put it right here can solve the Problem. 
	// Just Mack sure turn of action is Occur after the "stripslashes_deep" action has done.
	if(ini_get('magic_quotes_sybase') && function_exists('ini_set')) {
		ini_set( 'magic_quotes_sybase', 0 );
	}
	
	// Escape with wpdb
	$_GET    = add_magic_quotes( $_GET    );
	$_POST   = add_magic_quotes( $_POST   );
	$_COOKIE = add_magic_quotes( $_COOKIE );
	$_SERVER = add_magic_quotes( $_SERVER );

	// Force REQUEST to be GET + POST
	$_REQUEST = array_merge( $_GET, $_POST );
}
}

[solarissmoke]

Related #18322

[kurtpayne]

I can reproduce this. Here's what's happening:

1. $_POST comes in with sybase quotes (e.g. Charlie''s little cat)
2. magic_quotes_sybase is disabled
3. stripslashes() is run on $_POST which respects sybase quotes settings.
   1. With sybase quotes disabled (current behavior), stripslashes is looking for \' instead of '' and this is not converted correctly.
   2. With sybase quotes still enabled (@summerblue's solution), stripslashes is looking for '', and the input is converted properly (e.g. Charlie''s -> Charlie's), then magic_quotes_sybase is disabled

I tested this solution on all possible combinations of magic_quotes_gpc, magic_quotes_runtime, and magic_quotes_sybase with no problems.

[chriscct7]

Refreshed patch

[pento]

I'm cool with committing this, if it has some unit tests.

[wonderboymusic]

I can't reproduce this - does anyone have definitive steps?

[lucatume]

I've added a first unit tests draft for the patch and am open to suggestions about extension and modifications.

[lucatume]

Unit tests first draft

[johnbillion]

Working on this at WordPress Contributor Day Milan. We've realised that this requires PHP < 5.4 and magic_quotes_sybase to be enabled.

Using phpbrew we've reproduced the problem. @lucatume is working on updated tests.

[lucatume]

Here is the modified version of the tests that's taking care of setting the magic_quotes_sybase to 1 before running the tests.

Contribution made during 11/7 Contributor Day in Milan, Italy.

[lucatume]

Modified version of the tests to set ini settings before each

[johnbillion]

In 35639:

On servers running PHP <= 5.4 which have magic_quotes_sybase enabled, the superglobals need to be magic-quoted before magic_quotes_sybase is subsequently disabled to avoid incorrect un-slashing. This must surely effect a miniscule number of servers, but so be it.

Fixes #19455
Props summerblue, kurtpayne, lucatume

[johnbillion]

Got some breakage on PHP 5.2. ​https://travis-ci.org/aaronjorbin/develop.wordpress/jobs/91287128

[johnbillion]

In 35641:

Revert [35639] pending investigation into failures on PHP 5.2.

See #19455

[johnbillion]

I'm getting a bunch of build errors when trying to install PHP 5.2 with phpbrew, so this will have to be punted for now.