[wp-trac] [WordPress Trac] #10360: $_REQUEST's slashes may differ from $_GET/$_POST

[WordPress Trac]

#10360: $_REQUEST's slashes may differ from $_GET/$_POST
--------------------------+-------------------------------------------------
 Reporter:  dd32          |       Owner:  ryan        
     Type:  defect (bug)  |      Status:  new         
 Priority:  normal        |   Milestone:  2.8.2       
Component:  Security      |     Version:  2.8         
 Severity:  normal        |    Keywords:  dev-feedback
--------------------------+-------------------------------------------------

Comment(by vladimir_kolesnikov):

 Replying to [comment:23 Denis-de-Bernardy]:
 > @hakre: ticket is not invalid, and not slashing $_REQUEST can introduce
 potential security issues if a plugin uses it expecting it's always
 slashed.

 On the other hand, this might break the plugins that relied upon the old
 behavior (for example, if I know that $_REQUEST is unslashed, I can pass
 its variables (without applying stripslashes()) to
 $wpdb->insert()/$wpdb->update()).

 I agree that relying upon $_REQUEST is a bad practice that should be
 avoided unless you know what you do; what I dislike is that hacking with
 $_REQUEST breaks 3rd party software.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/10360#comment:25>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software