moved magic quotes handling into params() and cookie()