MFH: Fixed bug #25836 (last key of multi-dimensional array passed via GPC

not being escaped when magic_quotes_gpc is on).

diff --git a/NEWS b/NEWS
index aab8bbbc6e4aad8c12ec493b75c9616e574047c8..6093cd5bab6cd615e4b22218178627ddea1606fd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP 4                                                                      NEWS
 ?? Oct 2003, Version 4.3.4RC2
 - Fixed multibyte regex engine to properly handle ".*" pattern under
   POSIX compatible mode. (K.Kosako <kosako at sofnec.co.jp>, Moriyoshi)
+- Fixed bug #25836 (last key of multi-dimensional array passed via GPC not
+  being escaped when magic_quotes_gpc is on). (Ilia)
 - Fixed bug #25814 (Make flock() return correct value when 3rd argument is
   used). (Ilia)
 - Fixed bug #25800 (parse_url() could not parse urls with empty port). (Ilia)

diff --git a/main/php_variables.c b/main/php_variables.c
index eadb11568e83b6d506cd813eddce3e71b5bdb315..58bf2f5583cab2a4be046a80eac8e081e14e1c2d 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -178,7 +178,13 @@ plain_var:
                        if (!index) {
                                zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
                        } else {
-                               zend_hash_update(symtable1, index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                               if (PG(magic_quotes_gpc) && (index!=var)) {
+                                       char *escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC);
+                                       zend_hash_update(symtable1, escaped_index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                                       efree(escaped_index);
+                               } else {
+                                       zend_hash_update(symtable1, index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+                               }
                        }
                        break;
                }