WordPress plugins and problem with magic_quotes_gpc

Question

Hi, I want to write some plugin which adds forms in administration panel and in blog posts. I'm struggling now with magic_quotes.

First I've tried to use magic_quotes_gpc as in clear PHP. But it looks like WordPress ignores this flag and always quotes submitted form contents (at least forms in posts, forms in administration panel are not quoted).

But then I uploaded my plugin to DreamHost and it acts in a different way.

What is the correct way to process submitted form contents in WordPress plugins?

Answer 1

Basically, you seem to have a different PHP configuration between (presumably) your development environment and Dreamhost. I assume you would like your plugin to be able to handle both scenarios: magic_quotes on and off. Here's some ideas/thoughts.

• You can't always change php.ini settings at runtime - it depends on the server configuration.

• You can't always change the php.ini either. On Dreamhost this is possible, but unsupported.

• You can detect if magic_quotes is activated with ini_get().

• magic_quotes_gpc essentially runs addslashes() on all GET, POST, and COOKIE data

• You can perform the inverse operation with stripslashes().

A common technique is to write a simple wrapper for accessing parameters (GET/POST/COOKIE), such as:

function myplugin_param($name)
{
    if (ini_get('magic_quotes_gpc'))
    {
        return stripslashes($_REQUEST[$name]);
    }
    return $_REQUEST[$name];
}

Hope that helps!