Req #68287 [NEW]: short_open_tag should not include <?=...?>

From: patchcord at gmx dot net Operating system: PHP version: 5.4.34 Package: PHP options/info functions Bug Type: Feature/Change Request Bug description:short_open_tag should not include <?=...?> Description: ------------ In PHP Docs, there is stated that if 'short_open_tag=FALSE' this also covered the shorthand <?=, but only prior to PHP 5.4.0. I am wondering why this thing has been got back and for what reason? Putting <?= ... ?> for echoing, in general, is a specific practice, and this is insecure for some cases, which I will try to describe below. There are lots of so called "shell scripts" which are often included in binary files as PHP parts and later executed, causing websites for different illness. My current solution is a simple scanning of uploaded binary files for '<?php' strings inside. I suppose there is only a very small percent of binary files, which will contain '<?php' as the part of their original binary code. Even if so, there is no problem for me if such file wouldn't be uploaded. Still, there are lots of binary files, having '<?' or '<?=' as their original parts, so it's impossible relay on scanning of those tags, 'cause they couldn't be the parts of the shell script. Setting 'short_open_tag=FALSE', earlier, I have achieved that even if something binary is being uploaded, yet having '<?' or '<?=' inside, this will simply not execute. On the other hand, something which could be executed like '<?php' will not be allowed to upload. THIS protected the website with the uploaded files feature for a long time. NOW, when '<?=' is allowed EVEN if 'short_open_tag=FALSE', this breaks the security, because shell scripts could adopt to this directive and 'echo' something functional. I've already seen this couple of times. QUESTION: is there still a way to DISABLE '<?=', an if not, wouldn't be better to introduce an extra option which DISABLES this? For example, instead of just TRUE/FALSE, there could be: short_open_tag = 0; //completely disables any tag except <?php incl. <?= short_open_tag = 1; //disables <? but allows <?= and <?php short_open_tag = 2; //allows all <?, <?php, <?= I'm just not sure how many coders are truly up to using <?= in their scripts. Do you have the statistics? I think, allowing just <?php is suitable for all cases. But even if someone needs this or that, this could be re-configured... By now, it's strictly forced and it's a bit wrong. Thanks for attention and hoping this option will be up in PHP again. -- Edit bug report at https://bugs.php.net/bug.php?id=68287&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68287&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68287&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68287&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68287&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68287&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68287&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68287&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68287&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68287&r=support Expected behavior: https://bugs.php.net/fix.php?id=68287&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68287&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68287&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68287&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68287&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68287&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68287&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68287&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68287&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68287&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68287&r=mysqlcfg