Test For Checking Magic Quotes Gpc is On

There are many servers running PHP with magic_quotes_gpc is on . Enabling this makes the server inconsistent and ineffective. Beagle recommends not to enable magic_quotes_gpc. The magic_quotes_gpc escapes ‘(single quotes),”(double quotes), () and NUL with a backslash automatically. This vulnerability makes easier for remote attackers to conduct SQL injection attacks using a custom request. This vulnerability can be fixed by filtering programming/input php scripts to protect the databases and web application.

Example

The following is an example of magic_quotes_gpc

        magic_quotes_gpc = on

    

Impact

The impact include:-

• SQL injection attack

Mitigation / Precaution

This vulnerability can be fixed by:-

• Using input filtering methods.
• Using updated versions of PHP.

Written by

Prathap

Co-founder, Director

Prathap has around 20 years of experience and has worked on various projects in leading companies like Hitachi, Toshiba, Schneider Electric, ABB, Panasonic, and MicroFuzzy. His expertise lies in architecting, designing, and developing secure projects covering various aspects of software development, processes, and methodology.