Host disabled stripslashes() What is a good way to replace/fix?

[deadeye]

str_replace()? preg_replace()?

Do I replace in each files with a new line of code or do I place an overriding version of the function (if possible) in some 'functions' php file?


Anyone with any suggestions?

[RodG]

Anyone with any suggestions?

Change hosts.

Cheers
RodG

[DrByte]

Seriously, a host who disables the stripslashes function doesn't know what they're doing. They probably think they're fixing a security problem, but in the end they're creating thousands. And that's probably why they're getting hacked.

Find a host who knows what they're doing.

[DrByte]

Meanwhile, while you work on finding a new host, the following ideas may lead you to a temporary bandage.

These were found as user-contributed examples on php.net, and I have NOT tested them. Use at your own risk ...


Idea A: Use a preg_replace_array call:
To use, replace stripslashes($s) with the following. Be sure to alter the $s to match whatever variable was originally being sent to stripslashes.

preg_replace(array('/\x5C(?!\x5C)/u', '/\x5C\x5C/u'), array('','\\'), $s);

Idea B: Create stripslashes2() like this and simply search/replace all previous calls to stripslashes with stripslashes2

function stripslashes2($string) {
    $string = str_replace("\\\"", "\"", $string);
    $string = str_replace("\\'", "'", $string);
    $string = str_replace("\\\\", "\\", $string);
    return $string;
}

AGAIN: NEITHER OF THESE HAVE BEEN VETTED FOR SECURITY OR THOROUGHNESS. USE AT YOUR OWN RISK.