[wp-hackers] Magic Quoting removal Road Map/Plan

[John Blackbourn]

On 10 June 2011 16:28, Jari Pennanen <ciantic at oksidi.com> wrote:
> Hi!
>
> Got perhaps better idea for first phase, encourage a wrapper for
> getting user inputs which gives the data always in *non-magic quoted*
> format:
>
>  function wp_get_post($key[, $defaultvalue=null]);
>  function wp_get_get($key[, $defaultvalue=null]);
>  function wp_get_request($key[, $defaultvalue=null]);
>
> These wrappers would allow developers to see when wp_magic_quotes can
> be removed == when most people use these wrapper functions in plugins.

That's fine, but you're straying from the issue at hand. If functions
like this were implemented we are still left with the $_GET and $_POST
superglobals that are currently quoted. The issue is that we cannot
remove quoting from these variables because it introduces a security
vulnerability for every plugin and theme that's been written up until
this point. If we can't remove quoting from the superglobals, this is
a fruitless exercise.