Premature Optimization

I've been working on a small ZF based application for work in the last few days, and it was running quite well on my local machine. But when time came to deploy - alas, we discovered that slashes are magically added before single quotes to all data. The dreaded magic_quotes_gpc "feature" was apparently on on that server - so instead of turning it off, I decided to make my application more portable by making it work regardless of magic_quotes_gpc's status.

Since my application was based on Zend Framework (as most of the stuff I write for work these days), I decided to do it in a reusable "Zend Way". So I created a Zend Controller Plugin to reverse the effects of magic_quotes_gpc:

PLAIN TEXT

PHP:

<?php
/**
* A Zend Controller Plugin dedicated to undoing the damage of magic_quotes_gpc
* in systems where it is on.
*
* @author Shahar Evron
* @version $Id$
*/
require_once 'Zend/Controller/Plugin/Abstract.php';
class MyApp_StripMagicQuotesPlugin extends Zend_Controller_Plugin_Abstract
{
/**
* Called before the action loop is started. Will internally strip all
* slashes off $request parameters
*
* @param Zend_Controller_Request_Abstract $request
*/
public function dispatchLoopStartup(Zend_Controller_Request_Abstract $request)
{
$params = $request->getParams();
array_walk_recursive($params, array($this, 'stripSlashes'));
$request->setParams($params);
}
/**
* Strip the slashes off an item in the Params array
*
* @param string $value
* @param string $key
*/
protected function stripSlashes(&$value, $key)
{
$value = stripslashes($value);
}
}

You place this plugin under your application library directory. Then, in your index.php bootstrap file, check if magic_quotes_gpc is enabled, at load and register the plugin:

PLAIN TEXT

PHP:

/**
* Setup controller
*/
$controller = Zend_Controller_Front::getInstance()
->setControllerDirectory('../application/controllers');
/**
* Load the magic_quotes_gpc undoing plugin if needed
*/
if (get_magic_quotes_gpc()) {
require_once 'MyApp/StripMagicQuotesPlugin.php';
$controller->registerPlugin(new MyApp_StripMagicQuotesPlugin());
}
// run!
$controller->dispatch();

Now, this is only loaded and executed in systems where magic_quotes_gpc is enabled. It probably has quite allot of overhead - so a best solution in production environments would be to turn magic_quotes_gpc off (consider the fact that PHP works hard to escape the input, and then works hard to undo it... what a waste!), but if you want to produce a portable application that can be installed anywhere (including on shared hosting environments), this is a good solution.

BTW I'm not really sure if this handles cookies - so there might be a more "correct" way to do this. If you have any suggestions, I'd be happy to hear them!