Why backslashes are being added to all the $_GET,

Question

I have a vps with cPanel/Whm/CentOS 5.5 and the problem is that all parameters sent to my server are being addslashed, I've checked out the PHP configuration and i found out that all the magic quotes are turned off and i don't know what causes this.

My code is so clean and i know every bit of it and i don't have any addslashes() or some sort of these functions. i only want to receive the parameters as they are.

URL: test.php?text=blah" ' " 'blah

<?php
echo $_GET["text"]; // Output blah\" \' \" \'blah
?>

How to turn off this thing?

Thanks

Answer 1

It's the magic_quotes_gpc variable in your php.ini (this is the first place to turn it off). You should really check of you are looking at the right file.

You can also turn it off in .htaccess or at runtime I believe. But if your host doesn't won't let you do either of these things you can use the following function that will word regardless of the current setting.

if(get_magic_quotes_gpc()) {

    $_POST      = array_map('stripslashes_deep', $_POST);
    $_GET       = array_map('stripslashes_deep', $_GET);
    $_COOKIE    = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST   = array_map('stripslashes_deep', $_REQUEST);
}

function stripslashes_deep($value) {

    return (is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value));
}

Answer 2

It's a (deprecated) security feature called "magic quotes," and it's possible to turn it off.

Answer 3

You have to disable magic_quotes_gpc.