Fixed bug #25836 (last key of multi-dimensional array passed via GPC

not being escaped when magic_quotes_gpc is on).

diff --git a/main/php_variables.c b/main/php_variables.c
index 13e21b500c8de2cd99b4abdfa6cc68812e431f5b..78b1863fd990c32c7057b1b3db7e6a74af37aa08 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -182,7 +182,9 @@ plain_var:
                        if (!index) {
                                zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
                        } else {
-                               zend_symtable_update(symtable1, index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                               char *escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC);
+                               zend_symtable_update(symtable1, escaped_index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                               efree(escaped_index);
                        }
                        break;
                }