{"id":25,"date":"2023-06-05T13:23:58","date_gmt":"2023-06-05T05:23:58","guid":{"rendered":"http:\/\/pro369.com\/php\/?p=25"},"modified":"2019-08-02T12:06:00","modified_gmt":"2019-08-02T04:06:00","slug":"%e7%95%b6magic-quotes-gpcoff","status":"publish","type":"post","link":"https:\/\/por.tw\/php\/%e7%95%b6magic-quotes-gpcoff\/","title":{"rendered":"\u7576magic_quotes_gpc=off"},"content":{"rendered":"

\u7576magic_quotes_gpc=off<\/strong><\/span>
\nPstzine0x03\u88e1”[0x06] \u9ad8\u7d1aPHP\u4ee3\u78bc\u5be9\u6838\u6280\u8853”\u4e00\u6587\u4e2d\u95dc\u65bc “5.3.6 \u8b8a\u6578key\u8207\u9b54\u8853\u5f15\u865f” \u90e8\u5206\u7684php\u539f\u59cb\u7a0b\u5f0f\u78bc\u5206\u6790
\nauthor: ryat#www.wolvez.org
\nteam:http:\/\/www.80vul.com
\ndate:2009-04-10
\n\u4e00\u3001\u7d9c\u8ff0
\nmagic_quotes_gpc\u662fphp\u4e2d\u7684\u4e00\u500b\u5b89\u5168\u9078\u9805,\u5728php manual\u4e2d\u5c0d\u6b64\u6709\u5982\u4e0b\u63cf\u8ff0:
\nWhen on, all ‘ (single-quote), ” (double quote), (backslash) and NULL characters are escaped with a backslash automatically. This is identical to what addslashes() does
\n\u96d6\u7136magic_quotes_gpc\u6709\u52a9\u65bc\u63d0\u5347\u7a0b\u5f0f\u7684\u5b89\u5168\u6027\u4e26\u4e14\u5728php\u4e2d\u9ed8\u8a8d\u958b\u555f,\u4f46\u540c\u6642\u4e5f\u5e36\u4f86\u4e86\u5176\u4ed6\u7684\u4e00\u4e9b\u554f\u984c,\u56e0\u6b64\u5728php6\u4e2d\u5c07\u53bb\u6389\u6b64\u9078\u9805\u3002
\n\"\"
\n\u4e8c\u3001\u7576magic_quotes_gpc=off
\n\u8003\u616e\u5230\u90e8\u5206\u4f3a\u670d\u5668\u95dc\u9589\u4e86magic_quotes_gpc\u6216\u8005\u5176\u4ed6\u7684\u4e00\u4e9b\u539f\u56e0[\u5982\u5f71\u97ff\u529f\u80fd\u7b49],\u5f88\u591a\u7a0b\u5f0f\u5728\u5982magic_quotes_gpc=off\u4e0b\u81ea\u5df1\u5be6\u73fe\u4e00\u500b\u4ee3\u78bc\u4f86\u985e\u6bd4magic_quotes_gpc=on\u7684\u60c5\u6cc1. \u5982\u4e0b\u9762\u7684\u4e00\u6bb5\u4ee3\u78bc:
\ndefine(‘MAGIC_QUOTES_GPC’, get_magic_quotes_gpc());
\n…
\nforeach(array(‘_COOKIE’, ‘_POST’, ‘_GET’) as $_request) {
\nforeach($$_request as $_key => $_value) {
\n$_key{0} != ‘_’ && $$_key = daddslashes($_value);
\n}
\n}
\n…
\nfunction daddslashes($string, $force = 0) {
\n!defined(‘MAGIC_QUOTES_GPC’) && define(‘MAGIC_QUOTES_GPC’, get_magic_quotes_gpc());
\nif(!MAGIC_QUOTES_GPC || $force) {
\nif(is_array($string)) {
\nforeach($string as $key => $val) {
\n$string[$key] = daddslashes($val, $force);
\n}
\n} else {
\n$string = addslashes($string);
\n}
\n}
\nreturn $string;
\n}
\n\u5229\u7528addslashes()\u51fd\u6578\u985e\u6bd4\u4e86magic_quotes_gpc=on\u6642\u7684\u6548\u679c,\u770b\u4e0a\u53bb\u5f88\u5b8c\u7f8e,\u5176\u5be6\u662f\u6709\u7f3a\u9677\u7684\u6216\u8005\u8aaa\u53ea\u662f\u985e\u6bd4\u4e86magic_quotes_gpc\u7684\u90e8\u5206\u529f\u80fd.
\n\u4e09\u3001magic_quotes_gpc\u7684\u4ee3\u78bc\u5206\u6790
\nphp\u5728\u8a3b\u518a$_GET\/$_POST\u7b49\u8d85\u5168\u57df\u8b8a\u6578\u6642magic_quotes_gpc\u90e8\u5206\u7684\u4ee3\u78bc:
\n\/\/ php_variables.c
\nPHPAPI void php_register_variable_safe(char *var, char *strval, int str_len, zval *track_vars_array TSRMLS_DC)
\n{
\n\/\/ \u5c0d\u8b8a\u6578\u503c\u7684\u8655\u7406
\n…
\nif (PG(magic_quotes_gpc)) {
\nZ_STRVAL(new_entry) = php_addslashes(strval, Z_STRLEN(new_entry), &Z_STRLEN(new_entry), 0 TSRMLS_CC);
\n} else {
\nZ_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry));
\n}
\n…
\nPHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars_array TSRMLS_DC)
\n{
\n\/\/ \u5c0d\u8b8a\u6578\u540d\u7684\u8655\u7406
\n…
\nzend_bool is_array = 0;
\n…
\nfor (p = var; *p; p++) {
\nif (*p == ‘ ‘ || *p == ‘.’) {
\n*p=’_’;
\n} else if (*p == ‘[‘) {
\nis_array = 1;
\nip = p;
\n*p = 0;
\nbreak;
\n}
\n}
\nvar_len = p – var;
\n\/\/ \u4e0a\u9762\u9019\u6bb5\u4ee3\u78bc\u6c92\u6709\u8003\u616e\u8b8a\u6578\u540d\u7684\u539f\u59cb\u9577\u5ea6,\u6240\u4ee5\u9019\u88e1\u662fnot binary safe
\n\/\/ \u4e5f\u5c31\u662f\u8aaa,\u63d0\u4ea4 test.php?ryat%00wst=1 \u5c07\u6703\u751f\u6210$_GET[‘ryat’]=1
\n…
\nif (is_array) {
\n\/\/ \u5982\u679c\u8b8a\u6578\u540d\u662f\u9663\u5217\u7684\u5f62\u5f0f
\n…
\n} else {
\n\/\/ php > 5.2.1
\nif (PG(magic_quotes_gpc)) {
\n\/\/ php = 4.x && php <= 5.2.1
\n\/\/ if (PG(magic_quotes_gpc) && (index!=var)) {
\nescaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC);
\n} else {
\nescaped_index = index;
\n}
\n…
\n} else {
\n\/\/ \u9019\u90e8\u5206\u7684magic_quotes_gpc\u8655\u7406\u548c\u4e0a\u9762\u4e00\u6a23
\n…
\n\u7531\u4e0a\u9762\u7684\u4ee3\u78bc\u53ef\u4ee5\u770b\u5230,magic_quotes_gpc=on\u6642\u4e0d\u50c5\u50c5\u7528addslashes\u8655\u7406\u4e86\u8b8a\u6578\u503c,\u800c\u4e14\u8655\u7406\u4e86\u8b8a\u6578\u540d[\u65e2$_GET\/$_POST\u7b49\u8d85\u5168\u57df\u8b8a\u6578\u7684key,\u53e6\u5916\u8981\u6ce8\u610f\u7684\u662f:[1]\u5728php4\u548cphp<5.2.1\u7684\u7248\u672c\u4e2d,\u4e0d\u8655\u7406\u7b2c\u4e00\u7dad\u7684key:)]
\n\u800c\u524d\u9762\u90a3\u6bb5\u6a21\u64ecmagic_quotes_gpc\u7684\u4ee3\u78bc\u50c5\u50c5\u8655\u7406\u4e86\u9663\u5217\u7684\u503c,\u56e0\u6b64\u662f\u5b58\u5728\u5b89\u5168\u96b1\u60a3\u7684\u3002
\n\u56db\u3001\u5be6\u4f8b[ECShop SQL injection \u6f0f\u6d1e\u5206\u6790]
\n\u6587\u4ef6includes\/init.php\u5224\u65b7get_magic_quotes_gpc(),\u5982\u679c\u70baoff\u5247\u8abf\u7528addslashes_deep():
\n\/\/ includes\/init.php
\nif (!get_magic_quotes_gpc())
\n{
\nif (!empty($_GET))
\n{
\n$_GET = addslashes_deep($_GET);
\n}
\nif (!empty($_POST))
\n{
\n$_POST = addslashes_deep($_POST);
\n}
\n$_COOKIE = addslashes_deep($_COOKIE);
\n$_REQUEST = addslashes_deep($_REQUEST);
\n}
\naddslashes_deep()\u5728\u6587\u4ef6includes\/lib_base.php\u88e1\u6700\u5f8c\u901a\u904eaddslashes()\u8655\u7406
\n\/\/ includes\/lib_base.php
\nfunction addslashes_deep($value)
\n{
\nif (empty($value))
\n{
\nreturn $value;
\n}
\nelse
\n{
\nreturn is_array($value) ? array_map(‘addslashes_deep’, $value) : addslashes($value);
\n\/\/ \u53ea\u8655\u7406\u4e86\u9663\u5217\u7684\u503c:)
\n}
\n}
\n\u4e0b\u9762\u770b\u4e0b\u5177\u9ad4\u7684\u5c0e\u81f4\u6f0f\u6d1e\u7684\u4ee3\u78bc,\u6587\u4ef6 pick_out.php\u88e1:
\n\/\/ pick_out.php
\nif (!empty($_GET[‘attr’]))
\n{
\nforeach($_GET[‘attr’] as $key => $value)
\n{
\n$key = intval($key);
\n$_GET[‘attr’][$key] = htmlspecialchars($value);
\n\/\/ foreach\u8655\u7406\u7684\u662f\u6307\u5b9a\u9663\u5217\u7684\u62f7\u8c9d,\u6240\u4ee5\u9019\u88e1\u7684\u8655\u7406\u4e26\u4e0d\u5f71\u97ff\u9663\u5217\u539f\u5148\u7684key\u548cvalue
\n\/\/ \u56e0\u6b64\u53ef\u4ee5\u5f15\u5165\u4efb\u610f\u7684key:)
\n\/\/ \u7a0b\u5f0f\u5e2b\u7684\u908f\u8f2f\u51fa\u4e86\u554f\u984c?
\n}
\n}
\n…
\nforeach ($_GET[‘attr’] AS $key => $value)
\n{
\n$attr_url .= ‘&attr[‘ . $key . ‘]=’ . $value;
\n$attr_picks[] = $key;
\nif ($i > 0)
\n{
\nif (empty($goods_result))
\n{
\nbreak;
\n}
\n\/\/ \u5229\u7528key\u9032\u884c\u6ce8\u5c04:)
\n$goods_result = $db->getCol(“SELECT goods_id FROM ” . $ecs->table(“goods_attr”) . ” WHERE goods_id IN (” . implode(‘,’ , $goods_result) . “) AND attr_id=’$key’ AND attr_value=’$value'”);
\n\u7531\u65bcmagic_quotes_gpc=off\u6642\u6c92\u6709\u5c0d$key\u8655\u7406,\u540c\u6642\u5728\u9663\u5217\u8ce6\u503c\u6642\u5b58\u5728\u908f\u8f2f\u554f\u984c,\u6700\u7d42\u5c0e\u81f4\u4e86\u6ce8\u5c04\u6f0f\u6d1e:)
\nEXP:
\nhttp:\/\/www.80vul.com\/exp\/ecshop-pch-005.txt
\n\u4e94\u3001\u53c3\u8003:
\nhttp:\/\/bugs.php.net\/bug.php?id=41093<\/p>\n","protected":false},"excerpt":{"rendered":"

\u7576magic_quotes_gpc=off Pstzine0x03\u88e1”[0x06] \u9ad8\u7d1aPHP\u4ee3\u78bc […]<\/p>\n","protected":false},"author":1,"featured_media":385,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[22],"class_list":["post-25","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-php","tag-php"],"_links":{"self":[{"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/posts\/25"}],"collection":[{"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/comments?post=25"}],"version-history":[{"count":0,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/posts\/25\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/media\/385"}],"wp:attachment":[{"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/media?parent=25"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/categories?post=25"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/por.tw\/php\/wp-json\/wp\/v2\/tags?post=25"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}