Magic Quotes — What They Were and Why Removed
debt(d5/e7/b3/t7)
Closest to 'specialist tool catches it' (d5). The detection_hints list rector and semgrep — both specialist static analysis tools — as the automated detection mechanism. Code patterns like stripslashes($_POST) and get_magic_quotes_gpc() can be flagged by semgrep rules, but a default linter won't catch them and the compiler won't complain, so d5 is the right anchor.
Closest to 'cross-cutting refactor across the codebase' (e7). The quick_fix describes a bootstrap shim plus systematic replacement of all parameterised queries — that is explicitly a cross-cutting change. The common_mistakes reinforce that removing magic quotes without auditing every stripslashes() call and every database interaction is dangerous, meaning the fix necessarily spans multiple files and layers of the application.
Closest to 'localised tax' (b3). The applies_to scope is web-only and the feature was removed at PHP 5.4, so any living codebase either never had it or has already migrated. The burden is therefore historical: legacy codebases pay a localised remediation tax (auditing stripslashes calls, adding parameterised queries), but new code is completely unaffected and the choice doesn't shape the ongoing system architecture.
Closest to 'serious trap' (t7). The misconception field is explicit: developers believed magic quotes prevented SQL injection, but they did not. This contradicts how a security-escaping mechanism is expected to behave — it gave false confidence while remaining bypassable, and the 'obvious' migration step (just remove magic quotes) actively corrupts stored data. The common_mistakes confirm the trap is both security-critical and data-destructive, warranting t7.
Also Known As
TL;DR
Explanation
Magic quotes (magic_quotes_gpc) automatically ran addslashes() on all GET, POST, and COOKIE data. The intent was to prevent SQL injection, but the implementation was flawed: it escaped everything whether or not it reached a database, double-escaped already-escaped data, and gave false confidence. PHP 5.3 deprecated it, PHP 5.4 removed it. Code from this era often calls stripslashes() to undo the escaping — a reliable signal you are reading legacy PHP 3/4/5 code.
Common Misconception
Why It Matters
Common Mistakes
- Removing magic_quotes_gpc emulation without adding prepared statements
- Forgetting stripslashes() calls exist to undo magic quotes
- Assuming PHP 7+ apps inherited the escaping behaviour
Code Examples
// PHP 4/5 with magic_quotes_gpc=On:
$name = $_GET['name']; // "O\'Brien" — auto-escaped
mysql_query("SELECT * FROM users WHERE name='$name'");// Modern PHP — explicit PDO parameterisation:
$stmt = $pdo->prepare('SELECT * FROM users WHERE name = ?');
$stmt->execute([$_GET['name'] ?? '']);
$users = $stmt->fetchAll();