PHP should be shipped with magic_quotes_gpc = Off in php.ini

A good source of information:

http://www.jimmysworld.org/article.html?aID=59

What do you guys think?

chuck

This seems to me like no issue anymore, since

http://php.net/magic_quotes says:

Warning

This feature has been DEPRECATED and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged.

Ubuntu ships with version < PHP6, and it's likely that before 8.10 there will be no PHP6, so this is an issue.
I reiterate my point. Novice developers will learn PHP with bad configuration, they won't (or badly) escape variables = create security holes in their applications. Other developers will simply edit php.ini after fresh install.
To fix this bug by yourself it's very easy, but it's Important that Ubuntu offer good packages by default. Why don't fix that ?

"Warning
This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged."

This feature will clearly be disabled in the near future.

This configuration encourages bad development practice and in doing so encourages SQL injection vulnerabilities in PHP applications developed on Ubuntu.

magic_quotes_gpc offers no protection against sophisticated injection attacks, and enabling it only serves to give novice developers a false sense of security. Developers who see that it is enabled are less likely to consider using practices that are guaranteed to prevent injection vulnerabilities.

The feature only still exists for legacy compatibility, and enabling it by default is an illogical and dangerous mistake which should be corrected as soon as possible. It is a disservice to the developer community to wait for PHP 6 to fix this problem.

I suggest you all read the discussion in the debian bug before commenting further.

5.3.x will hit unstable soon and it will have it Off by default. In Ubuntu I guess you'll have to wait till development of 9.10 and the merge from unstable will happen again.

This is fixed as well.
Regards
chuck