Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've been writing some Wordpress plugins, and I've been having some problem with Wordpress putting magic quotes on POST and GET data.

Specifically, the "wp_magic_quotes" function in \wp-includes\load.php, which is called (presumably on every response) in wp-settings.php. This function adds magic quotes to the data even if I turn off magic quotes in PHP settings.

/**
 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 *
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
 * or $_ENV are needed, use those superglobals directly.
 *
 * @access private
 * @since 3.0.0
 */
function wp_magic_quotes() {
    // If already slashed, strip.
    if ( get_magic_quotes_gpc() ) {
        $_GET    = stripslashes_deep( $_GET    );
        $_POST   = stripslashes_deep( $_POST   );
        $_COOKIE = stripslashes_deep( $_COOKIE );
    }

    // Escape with wpdb.
    $_GET    = add_magic_quotes( $_GET    );
    $_POST   = add_magic_quotes( $_POST   );
    $_COOKIE = add_magic_quotes( $_COOKIE );
    $_SERVER = add_magic_quotes( $_SERVER );

    // Force REQUEST to be GET + POST.
    $_REQUEST = array_merge( $_GET, $_POST );
}

Is it safe for me to just comment out the wp_magic_quotes() call in wp-settings.php? That is, will it negatively affect the normal Wordpress code and/or open up some exploitation vector? If so, is there some other way to do it besides modifying WP code (so I don't have to deal with this every time there's an update)?

share|improve this question

migrated from stackoverflow.com Jul 1 '11 at 9:30

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers 4

up vote 3 down vote accepted

Simply put WP turns indeterminate situation (magic quotes might or might not be enabled in server configuration) into determinate (magic quotes are always present and server configuration does not matter).

Rather than messing with this for all WP core it makes much more sense to simply strip slashes in your code on your own variables, when you need that.

share|improve this answer
add comment

The current behavior in WordPress is best practice based on the compatibility of all PHP systems and configurations. WordPress has always normalized $_GET, $_POST, $_COOKIE, and $_SERVER to be slashed, and expect that it will continue to do so.

So, to extract a POST or a GET parameter we have to write:

$value = stripslashes_deep($_POST['name']); or

$value = stripslashes_deep($_GET['name']);
share|improve this answer
add comment

I was recently having this problem and I finally figured it out. I was basically search almost every website on magic quotes on wordpress and none of them helped.

This is how to fix it:

1) go into your wp-settings.php

2) search for wp_magic_quotes();

3) just comment it out and it should work now

reason why this works

This works because if you look before that code you'll see:

// Disable magic quotes at runtime. Magic quotes are added using wpdb later in //wp-settings.php.

@ini_set( 'magic_quotes_runtime', 0 ); @ini_set( 'magic_quotes_sybase', 0 );

That Magic quotes that is added later on using wpdb is what is messing most people up and it happens to be wp_magic_quotes(). Just commenting that will prevent magic quotes from messing you up.

share|improve this answer
1  
Bad idea: after the next upgrade this change is lost. –  toscho Mar 31 '13 at 17:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.