Magic quotes and security - Revision history

Phild: added information for J!3.0 and notice of MQ

2013-02-19T19:56:45Z

added information for J!3.0 and notice of MQ

Wilsonge: Add incomplete due to no mention of JInput

2013-02-03T20:21:01Z

Add incomplete due to no mention of JInput

Chris Davenport: Reverted edits by Tom6 (talk) to last revision by Fredden

2012-02-03T00:17:43Z

Reverted edits by Tom6 (talk) to last revision by Fredden

Tom6: Blanked the page

2012-02-02T23:48:19Z

Blanked the page

Fredden at 02:23, 26 September 2011

2011-09-26T02:23:42Z

Royce: Minor misspelling - depreciated != deprecated

2011-06-26T21:44:57Z

Minor misspelling - depreciated != deprecated

Wilecoyote at 23:53, 10 March 2011

2011-03-10T23:53:51Z

Mandville at 03:11, 16 March 2010

2010-03-16T03:11:55Z

Mandville: New page: JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setti...

2010-03-16T03:09:53Z

New page: JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setti...

New page

JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setting doesn't matter. If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.

'''Magic Quotes Off''' there is an "increased" risk of SQL Injections due to poorly written
queries not being safely escaped in extensions hence the general PHP and JTS recommendation
that Magic Quotes be ON by default (although in the past PHP has left them
disabled in the default distribution) for a more secure environment.

This setting is now basically irrelevant (can be On or Off) due to the way that Joomla! has been written to overcome the problem of poorly written queries.

The setting is now depreciated and has actually been removed in later PHP releases anyway, hence developers of older PHP applications will need to complete a code review for compliance, and
safety, of which has already been completed by Joomla! quite some time ago and the issue was resolved with JRequest.

In the past, there has been much discussion regarding the performance implications of this setting, in general from my testing and experience, it was negligible at worst and unnoticed at best, unless the queries were very very large, but on the whole the trade-off of improved security against
SQL Injections far out ways any discussions surrounding performance.

For more on [http://us3.php.net/magic_quotes magic quotes]

Edited from a discussion on Joomla CMS development Mailing list between A Eddie, R Winter and C Mandville

@@ Line 1: / Line 1: @@
 {{incomplete|needs updating|JInput requires magic quotes being turned off and there are issues with this in Joomla 2.5. Article needs to be updated to reflect this}}
 JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly.  If developers are using JRequest to request input then the actual value of the setting doesn't matter.  If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.
@@ Line 15: / Line 22: @@
 SQL Injections far outweighs any discussions surrounding performance.
-For more on [http://php.net/magic_quotes magic quotes]
+For more on [http://php.net/magic_quotes PHP Manual, Chapter 31. Magic Quotes.]

← Older revision		Revision as of 20:21, 3 February 2013
Line 1:		Line 1:
		+	{{incomplete\|needs updating\|JInput requires magic quotes being turned off and there are issues with this in Joomla 2.5. Article needs to be updated to reflect this}}
	JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setting doesn't matter. If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.		JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setting doesn't matter. If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.

← Older revision		Revision as of 23:48, 2 February 2012
Line 1:		Line 1:
−	JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setting doesn't matter. If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.

−	~~'''Magic Quotes Off''' there is an "increased" risk of SQL Injections due to poorly written~~
−	~~queries not being safely escaped in extensions hence the general PHP and JTS recommendation~~
−	~~that Magic Quotes be ON by default (although in the past PHP has left them~~
−	~~disabled in the default distribution) for a more secure environment.~~
−
−	~~This setting is now basically irrelevant (can be On or Off) due to the way that Joomla! has been written to overcome the problem of poorly written queries.~~
−
−	~~The setting is now deprecated and has actually been removed in later PHP releases anyway, hence developers of older PHP applications will need to complete a code review for compliance, and~~
−	~~safety, of which has already been completed by Joomla! quite some time ago and the issue was resolved with JRequest.~~
−
−	In the past, there has been much discussion regarding the performance implications of this setting, in general from my testing and experience, it was negligible at worst and unnoticed at best, unless the queries were very very large, but on the whole the trade-off of improved security against
−	~~SQL Injections far outweighs any discussions surrounding performance.~~
−
−	~~For more on [http://php.net/magic_quotes magic quotes]~~
−
−
−	~~Edited from a discussion on Joomla CMS development Mailing list between A Eddie, R Winter and C Mandville~~
−
−	~~<!-- KEEP THIS AT THE END OF THE PAGE -->~~
−	~~[[Category:Security Checklist]]~~

← Older revision		Revision as of 02:23, 26 September 2011
Line 14:		Line 14:
	SQL Injections far outweighs any discussions surrounding performance.		SQL Injections far outweighs any discussions surrounding performance.

−	For more on [http://~~us3.~~php.net/magic_quotes magic quotes]	+	For more on [http://php.net/magic_quotes magic quotes]

← Older revision		Revision as of 03:11, 16 March 2010
Line 18:		Line 18:

	Edited from a discussion on Joomla CMS development Mailing list between A Eddie, R Winter and C Mandville		Edited from a discussion on Joomla CMS development Mailing list between A Eddie, R Winter and C Mandville
		+
		+	<!-- KEEP THIS AT THE END OF THE PAGE -->
		+	[[Category:Security Checklist]]

← Older revision	Revision as of 00:17, 3 February 2012
Line 1:	Line 1:
	+	JRequest automatically takes into account the setting of ''magic_quotes_gpc'' and adjusts accordingly. If developers are using JRequest to request input then the actual value of the setting doesn't matter. If developers aren't using it then they will have to take the setting of magic_quotes_gpc into account.

	+	'''Magic Quotes Off''' there is an "increased" risk of SQL Injections due to poorly written
	+	queries not being safely escaped in extensions hence the general PHP and JTS recommendation
	+	that Magic Quotes be ON by default (although in the past PHP has left them
	+	disabled in the default distribution) for a more secure environment.
	+
	+	This setting is now basically irrelevant (can be On or Off) due to the way that Joomla! has been written to overcome the problem of poorly written queries.
	+
	+	The setting is now deprecated and has actually been removed in later PHP releases anyway, hence developers of older PHP applications will need to complete a code review for compliance, and
	+	safety, of which has already been completed by Joomla! quite some time ago and the issue was resolved with JRequest.
	+
	+	In the past, there has been much discussion regarding the performance implications of this setting, in general from my testing and experience, it was negligible at worst and unnoticed at best, unless the queries were very very large, but on the whole the trade-off of improved security against
	+	SQL Injections far outweighs any discussions surrounding performance.
	+
	+	For more on [http://php.net/magic_quotes magic quotes]
	+
	+
	+	Edited from a discussion on Joomla CMS development Mailing list between A Eddie, R Winter and C Mandville
	+
	+	<!-- KEEP THIS AT THE END OF THE PAGE -->
	+	[[Category:Security Checklist]]

@@ Line 8: / Line 8: @@
 This setting is now basically irrelevant (can be On or Off) due to the way that Joomla! has been written to overcome the problem of poorly written queries.
-The setting is now depreciated and has actually been removed in later PHP releases anyway, hence developers of older PHP applications will need to complete a code review for compliance, and
+The setting is now deprecated and has actually been removed in later PHP releases anyway, hence developers of older PHP applications will need to complete a code review for compliance, and
 safety, of which has already been completed by Joomla! quite some time ago and the issue was resolved with JRequest.

@@ Line 12: / Line 12: @@
 In the past, there has been much discussion regarding the performance implications of this setting, in general from my testing and experience, it was negligible at worst and unnoticed at best, unless the queries were very very large,  but on the whole the trade-off of improved security against
-SQL Injections far out ways any discussions surrounding performance.
+SQL Injections far outweighs any discussions surrounding performance.
 For more on [http://us3.php.net/magic_quotes magic quotes]