The only problem I can see with this is... do we wait for PHP6 as it seems to be becoming a bit of a Perl 6 (sorry for bringing this up)? I completely agree with it should only happen with major version change and most people won't see 5.x -> 5.y being a major change and therefore the end user expectation will be for things to generally to carry on working I'm not sure what the best answer is apart from jumping ahead with a PHP6, but is it really worth jumping the gun just for MQ's etc?
-----Original Message----- From: patrickalla...@php.net [mailto:patrick.alla...@gmail.com] On Behalf Of Patrick ALLAERT Sent: 18 November 2010 10:41 To: Kalle Sommer Nielsen Cc: Internals Subject: Re: [PHP-DEV] Magic quotes in trunk 2010/11/17 Kalle Sommer Nielsen <ka...@php.net>: > Greetings > > I wanted to raise this topic before we go Alpha with trunk, regarding > our beloved magic_quotes feature. There seems to be mixed opinions > regarding it so I thought I would take it up for discussion. > > We have advised people not to use magic_quotes, register_globals and > the like for years, and they were marked as deprecated in 5.3.0+ if > activated through their php.ini directives. Yet magic_quotes still is > set to "On" in 5.3.0. I think its worth we either remove the feature > or disable it in trunk as its a security related feature. Lets have a > look at what each of those options means: > > Removing magic_quotes): > Means we will remove the feature entirely in the source, we will throw > an E_CORE_ERROR if activated so people who have it enabled are forced > to disable it and make their applications work without magic_quotes. > This creates a minor issue for the hosts that simply disable it and > have their customers applications run without them which can create a > security risk for them, although it should be fairly limited. The > functions to check for magic_quotes_runtime should however stay for BC > to avoid applications that run on multiple versions of PHP from doing: > if(function_exists('...') && ...) > > Disabling them): > This will help to disable the spread of magic_quotes even more, and it > can safely be removed in the next major version of PHP. > > > My personal vote here goes towards removing them entirely. > > > What are your inputs on this matter? > > -- > regards, > > Kalle Sommer Nielsen > ka...@php.net > > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php I am all for removing it but... Disabling it by default is the first mandatory step, [done] in PHP 5.3, magic_quotes_gpc has been turned off by default at the same time as providing a -development and -production version of the php.ini file. However, such a change might be risky in the PHP5 series! Release the exact same thing as PHP 5.4 or PHP 6, there is a big difference in the user perception. * Is my PHP 5.x application compatible with PHP 6? * Chance is higher that they will take more care reading a PHP 5.3 -> PHP 6 Migration guide than a 5.3 -> 5.4. +1 to remove it in PHP > 5 Patrick -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
