Index: .htaccess
===================================================================
RCS file: /cvs/drupal/drupal/.htaccess,v
retrieving revision 1.96
diff -u -9 -p -r1.96 .htaccess
--- .htaccess	15 Sep 2008 15:21:44 -0000	1.96
+++ .htaccess	3 Nov 2008 21:33:14 -0000
@@ -18,20 +18,21 @@ ErrorDocument 404 /index.php
 
 # Force simple error message for requests for non-existent favicon.ico.
 <Files favicon.ico>
   ErrorDocument 404 "The requested file favicon.ico was not found.
 </Files>
 
 # Set the default handler.
 DirectoryIndex index.php
 
-# Override PHP settings. More in sites/default/settings.php
-# but the following cannot be changed at runtime.
+# Override PHP settings that cannot be changed at runtime. See
+# sites/default/default.settings.php and drupal_initialize_variables() in
+# includes/bootstrap.inc for settings that can be changed at runtime.
 
 # PHP 5, Apache 1 and 2.
 <IfModule mod_php5.c>
   php_flag magic_quotes_gpc                 off
   php_flag register_globals                 off
   php_flag session.auto_start               off
   php_value mbstring.http_input             pass
   php_value mbstring.http_output            pass
   php_flag mbstring.encoding_translation    off
Index: includes/bootstrap.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v
retrieving revision 1.245
diff -u -9 -p -r1.245 bootstrap.inc
--- includes/bootstrap.inc	2 Nov 2008 10:56:35 -0000	1.245
+++ includes/bootstrap.inc	3 Nov 2008 21:33:15 -0000
@@ -370,20 +370,27 @@ function conf_path($require_settings = T
 function drupal_initialize_variables() {
   if (!isset($_SERVER['HTTP_REFERER'])) {
     $_SERVER['HTTP_REFERER'] = '';
   }
   if (!isset($_SERVER['SERVER_PROTOCOL']) || ($_SERVER['SERVER_PROTOCOL'] != 'HTTP/1.0' && $_SERVER['SERVER_PROTOCOL'] != 'HTTP/1.1')) {
     $_SERVER['SERVER_PROTOCOL'] = 'HTTP/1.0';
   }
   // Enforce E_ALL, but allow users to set levels not part of E_ALL.
   error_reporting(E_ALL | error_reporting());
+
+  // Override PHP settings required for Drupal to work properly. The .htaccess
+  // file contains settings that cannot be changed at runtime. See
+  // sites/default/default.settings.php for more non-runtime settings.
+
   // Prevent PHP from generating HTML errors messages.
   ini_set('html_errors', 0);
+  // Don't escape quotes when reading files from disk etc.
+  ini_set('magic_quotes_runtime', '0');
 }
 
 /**
  * Validate that $_SERVER['HTTP_HOST'] is safe.
  *
  * As $_SERVER['HTTP_HOST'] is user input, ensure it only contains characters
  * allowed in hostnames.  See RFC 952 (and RFC 2181). $_SERVER['HTTP_HOST'] is
  * lowercased.
  *
Index: sites/default/default.settings.php
===================================================================
RCS file: /cvs/drupal/drupal/sites/default/default.settings.php,v
retrieving revision 1.15
diff -u -9 -p -r1.15 default.settings.php
--- sites/default/default.settings.php	6 Oct 2008 10:54:15 -0000	1.15
+++ sites/default/default.settings.php	3 Nov 2008 21:33:15 -0000
@@ -182,27 +182,26 @@ $update_free_access = FALSE;
  *
  * It is not allowed to have a trailing slash; Drupal will add it
  * for you.
  */
 # $base_url = 'http://www.example.com';  // NO trailing slash!
 
 /**
  * PHP settings:
  *
- * To see what PHP settings are possible, including whether they can
- * be set at runtime (ie., when ini_set() occurs), read the PHP
- * documentation at http://www.php.net/manual/en/ini.php#ini.list
- * and take a look at the .htaccess file to see which non-runtime
- * settings are used there. Settings defined here should not be
- * duplicated there so as to avoid conflict issues.
+ * To see what PHP settings are possible, including whether they can be set at
+ * runtime (i.e., when ini_set() occurs), read the PHP documentation:
+ * http://www.php.net/manual/en/ini.php#ini.list
+ * See drupal_initialize_variables() in includes/bootstrap.inc for required
+ * runtime settings and the .htaccess file for non-runtime settings. Settings
+ * defined there should not be duplicated here so as to avoid conflict issues.
  */
 ini_set('arg_separator.output',     '&amp;');
-ini_set('magic_quotes_runtime',     0);
 ini_set('magic_quotes_sybase',      0);
 ini_set('session.cache_expire',     200000);
 ini_set('session.cache_limiter',    'none');
 ini_set('session.cookie_lifetime',  2000000);
 ini_set('session.gc_maxlifetime',   200000);
 ini_set('session.save_handler',     'user');
 ini_set('session.use_only_cookies', 1);
 ini_set('session.use_trans_sid',    0);
 ini_set('url_rewriter.tags',        '');