magic_quotes on php 5.3 will not go away

Question

I have an Ubuntu 10.04 server, running PHP 5.3.2 and I have these lines set in my php.ini file:

magic_quotes_gpc = Off
magic_quotes_runtime = Off
magic_quotes_sybase = Off

There are NO other php.ini files (I searched the whole hard drive), I checked ALL apache2 configuration files (including ALL .htaccess files on the entire hard drive), and they are not referenced anywhere else.

However:

<?php
    ini_set('display_errors', 1);
    error_reporting(E_ALL);
    var_dump(get_magic_quotes_gpc());
?>

Produces this output: int(1) That is, the magic quotes are on, which is easily verifiable by adding any type of request with quotes, and they will be quoted out. I have fixed this by adding the following to my root .htaccess file:

php_flag magic_quotes_gpc Off

The aforementioned code now produces the desired result: int(0), and no output is quoted.

So the question: why, oh dear God why, were the magic quotes on in the first place?! Yes, I know this question is similar to others that have been asked. I'm not looking for a "quick fix", and yes, I know magic quotes will be removed in php 5.4. But the truth is, I will need to maintain backwards compatibility for a few years after 5.4 comes out (different clients, etc), and so I'm trying to figure out why magic quotes were on. I know I can fix this by adding a line to my root .htaccess file (as I've shown), but I would much rather have a greater understanding of how my php.ini setting was overridden in the first place.

So does anyone have any ideas on how it could have been turned on?

Answer 1

I finally figured it out; update apache2 and php5:

apt-get update
apt-get install apache2 php5

This is a bug with certain versions in apache2 and/or php5. The version in Debian's apt universe has been updated, so just updating will fix the problem.

Answer 2

I had this same problem today, and found this question, but no apparent solution!

I finally solved the issue by also applying the magic_quotes_gpc = Off line in the last file in the /etc/php5/apache2/conf.d folder, so it seems something is overriding the original php.ini file, but applying the setting once more in the last included file actually turned magic_quotes back off again.

Answer 3

At the top of it's output PHPinfo() tells you the actual php.ini file used.

There are NO other php.ini files (I searched the whole hard drive), I checked ALL apache2 configuration files (including ALL .htaccess files on the entire hard drive), and they are not referenced anywhere else.

There is no magic either.
If it's set - it is set somewhere.

Answer 4

This worked for me:

I changed:

; Magic quotes
;


; Use Sybase-style magic quotes (escape ' with '' instead of \').
  magic_quotes_sybase = 0
  magic_quotes_gpc = 0
  magic_quotes_runtime = 0

to:

; Magic quotes
;


; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = 0
magic_quotes_gpc = 0
magic_quotes_runtime = 0

Had spaces before the settings, and wasted hours of time searching out every instance of magic_quotes, and every php.ini file or any .ini file at all.

(I did this in my .drush directory in drush.ini, but it will probably work in php.ini)