1. Some settings to set off

1.1 register_global

Why has it to be off ?

(todo)

1.2 magic_quote_gpc

Why has it to be off ?

The purpose of magic quoting is to prevent malicious code to be executed when you use datas from superglobals in sql statements, or in system, popen and other things like that

Why is it a bad idea to do that ? Well, when you print datas taken from a web form on a dynamic page, you have to escape html entities to avoid script attacks, and other malicious code injection. But do you run htmlentities on all your superglobals ? of course not !

2. What should I do then ?

2.1 I have no access to php.ini or .htacess, how can I revert quoting ?

For this case, of if you want your program to be magic_quote_gpc safe, you can use at the top of your pages the function below :


<?php
if (get_magic_quotes_gpc()) { // we do nothing if magic quotes off

    /** remove magic quotes from an array.
     * this function operate on a reference on an array for efficiency
     */
    function rm_magic_quotes(&$array) {
        foreach ($array as $k => $v) {
            if (is_array($v)) {
                rm_magic_quotes($v);
            } else {
                $array[$k] = addslashes($v);
            }
        }
    }
     
    // remove slashes (but not $_GLOBALS or $_SESSION !)
    rm_magic_quotes($_GET);
    rm_magic_quotes($_POST);
    rm_magic_quotes($_REQUEST);
    rm_magic_quotes($_COOKIE);
}
?>

2.2 Security policy wrt. php vars

PHP vars should not be trusted at all, you have to escape them a lot. But you can need quote escaping for sql statements, entities escaping for hypertext generation, ...

A good security policy is to apply by default the safer treatment, and to disable it for special cases. How to achieve that ?

For sql statements, the best place to do this is to manage vars escaping in a class handling the sql queries. It's often a good idea. You can for example use PEAR::MDB that does it for you
For entities escaping, there is no common method :(
But if you use a template engine, like Smarty, You should check if it doesn't provide default escaping. Smarty does, thanks to the variable Smarty::default_modifiers (here is the doc).

But consider that doing sth like a : htmlentities(escape(...)) on every php var is inefficient, and is a bad design. Security has to be used where it applies. Classical escaping sucks for html purpose, and you doesn't need to escape entities for sql statements.