I know it's possible to be able to turn magic_quotes on for particular sites on a virtual host by using .htaccess...

I have tried putting in the following:

php_flag magic_quotes_gpc on

to an already exisiting .htaccess page which deals with .htaccess security but when accessing a page which is covered by .htaccess, an 'internal error' message occurs and page is not viewable.

It would be fantastic if someone can tell me exactly how to use .htaccess to control magic_quotes - they are currently set to 'off' in php.ini and I do not want to change this apart from this one site that requires them on (due to external developer programming the site and I can't read his code therefore do not know where to addslashes!!!)

Any advise would of course be appreciated.

Check out this page:
http://mynews.alienated.org/story.php/view/5/

It says you need to have "AllowOverrides All" set in your apache config. Just a guess.
-dk

ARGH!!!

http://www.webmasterstop.com/tutoria...c-quotes.shtml

That should explain it all!

Thank you for both your replies, however as I'm not very familiar with the workings of httpd config file, I'm not too sure where abouts to place the AllowOverideAll line. I've just tried placing it with the rest of the virual directory settings, but apache told me (when restarted) that it wasn't allowed there!!

Re second reply - the article you pointed me to (which i had in fact read) was very funny and did raise a few good points - especialy regarding the use of stripslashes etc - however, it doesn't really tell you very much in terms of how to do certain things i.e. what do you type in to the .htaccess file and where and what do you type in in the httpd config file!!

Thank you anyway. If there is anyone else out there who can advise, it will be most welcome.

F

I was focusing more towards the 'DO NOT USE THIS METHOD' angle than in solving the dilemme of the .htaccess problem

Regarding the AllowOverideAll ... it is a tag in the main apache conf file which allows you to set up a .htaccess to override the PHP settings.

I will look into it ... lemme get back to you

I'm with you on not using magic_quotes - in fact I would so much rather use addslashes so we're talking the same language BUT i have been left with no choice as I cannot read my developers code so as to change it (I'm still learning PHP) and my client is having problems adding content through their content management system.

This bug somehow slipped through the net at testing stage and now I cannot get hold of the developer!!

!!

if you're stuck with:
magic_quotes_gpc = On

$var =
str_replace( array( "\\\"", "\\'"), array(""", "'"), $var );

in the script that receives the post/get from the form has been working for me quite nicely.