WordPress 中的魔术引号，以及如何摆脱它们

1
/**
2
 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
3
 *
4
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
5
 * or $_ENV are needed, use those superglobals directly.
6
 *
7
 * @access private
8
 * @since 3.0.0
9
 */
10
function wp_magic_quotes() {
11
    // If already slashed, strip.
12
    if ( get_magic_quotes_gpc() ) {
13
        $_GET    = stripslashes_deep( $_GET    );
14
        $_POST   = stripslashes_deep( $_POST   );
15
        $_COOKIE = stripslashes_deep( $_COOKIE );
16
    }
17

18
    // Escape with wpdb.
19
    $_GET    = add_magic_quotes( $_GET    );
20
    $_POST   = add_magic_quotes( $_POST   );
21
    $_COOKIE = add_magic_quotes( $_COOKIE );
22
    $_SERVER = add_magic_quotes( $_SERVER );
23

24
    // Force REQUEST to be GET + POST.
25
    $_REQUEST = array_merge( $_GET, $_POST );
26
}

1
class MyExamplePlugin {
2
    //Local copies of the PHP superglobals.
3
    private $get;
4
    private $post;
5
    private $cookie;
6

7
    public function __construct() {
8
        /* ... Other plugin code ... */
9

10
        add_action('plugins_loaded', array($this, 'captureRequestVars'));
11
    }
12

13
    public function captureRequestVars() {
14
        //Store the original GET and POST data + cookies.
15
        $this->get = $_GET;
16
        $this->post = $_POST;
17
        $this->cookie = $_COOKIE;
18

19
        //If magic quotes are actually enabled in PHP,
20
        //we'll need to remove the slashes.
21
        if ( get_magic_quotes_gpc() ) {
22
            $this->get    = stripslashes_deep($this->get);
23
            $this->post   = stripslashes_deep($this->post);
24
            $this->cookie = stripslashes_deep($this->cookie);
25
        }
26
    }
27

28
    public function doSomethingWithInput() {
29
        /* ... */
30

31
        //Use the internal copy of $_GET.
32
        $something = $this->get['something'];
33

34
        /* ... */
35
    }
36
}
37

38
$myExamplePlugin = new MyExamplePlugin();