The magic_quotes_gpc bug in phpWordPress, January 2005

The thread is a single bug notice. On 20 January 2005, phpWordPress staff wrote that they had noticed a bug related to magic_quotes_gpc. When that PHP setting was turned off, a “Bad insert query” error appeared in certain cases when someone posted a new article. They said the bug was fixed for version 2.5.2. A week later the 2.6.0 enhancement list repeated the fix under the line “Corrected magic_quotes_gpc bug”.

phpWordPress was a commercial PHP article manager from Spoonlabs, renamed Vivvo in 2006 and unrelated to WordPress. The release history covers the versions.

What was magic_quotes_gpc?

It was a PHP configuration setting, one of a family of “magic quotes” options that PHP once offered. The manual describes get_magic_quotes_gpc() as the function that gets the current configuration setting of magic_quotes_gpc. Software written for one state of the setting could misbehave when a host chose the other.

The archived post does not explain the exact failure. It only says the error appeared in certain cases when the setting was off. We have not tested the old code, so we do not claim a cause beyond what staff wrote.

What did this mean for publishers in 2005?

A publisher did not control the server’s PHP settings on shared hosting. The same copy of an article manager could work on one host and fail on another, depending on one directive. For an editor, the symptom was an article that would not save, with a database error message.

Two practical lessons follow from the thread. Hosting settings are part of what a CMS depends on, and a vendor that posts a dated, specific bug notice with the fixed version gives customers something to check against.

How does current software handle this?

The feature is gone. The PHP 5.4.0 release announcement says magic quotes and safe mode were removed. The manual page for get_magic_quotes_gpc() says the function was deprecated as of PHP 7.4.0 and removed as of PHP 8.0.0, and that earlier it always returned false.

That removes one class of host-to-host differences. Others remain: PHP version, memory limits and extensions all still vary between hosts. Before installing any CMS, read its stated requirements and compare them with what your host offers. The guides include checklists for that.

Is this still a publisher’s concern?

Only indirectly. The lesson that survives is that a CMS depends on its host. Current systems list their required PHP version and extensions, and a publisher should check those against the host before installing. A developer reviewing a plugin or custom code should check how it handles database input, since that is where this kind of bug appeared.

The Product Updates board holds other fix notices from the same period. In December 2005 staff told 2.6 users to move to 3.0 mainly for security reasons, which shows how quickly a single configuration bug sat beside wider upgrade questions.