Question

Today I run into some oddity with PHP, which I fail find a proper explanation for in the documentation. Consider the following code:

<?php
echo $_GET['t']. PHP_EOL;
?>

The code is simple – it takes a single t parameter on the url and outputs it back. So if you call it with test.php?t=%5Ca (%5c is a ‘\’), I expected to see:

\a

However, this is what I got:

$ curl http://localhost/~boaz/test.php?t=%5Ca
\\a

Notice the double slash. Can anyone explains what’s going on and give recipe for retrieving the strings as it was supplied on the URL?

Thanks,
Boaz

PS. I’m using PHP 5.2.11

Answer 1

This happens, because you have the “magic quotes” switch in php.ini switched on. From the manual:

When on, all ‘ (single-quote), ”
(double quote), \ (backslash) and NULL
characters are escaped with a
backslash automatically. This is
identical to what addslashes() does.

Read more about it here: http://php.net/manual/en/security.magicquotes.php

To make your script aware of any value of the “magic_quotes_gpc” setting in php.ini, you can write your script like this:

$d = $_GET["d"];
if (get_magic_quotes_gpc()) $d = stripslashes($d);
echo $d; //but now you are kind of vulnerable to SQL injections
         //if you don't properly escape this value in SQL queries.