Req #73536 [Nab]: var_dump ignore private permitions in class

Edit report at https://bugs.php.net/bug.php?id=73536&edit=1 ID: 73536 Updated by: rasmus@php.net Reported by: peter dot mlich at volny dot cz Summary: var_dump ignore private permitions in class Status: Not a bug Type: Feature/Change Request Package: Unknown/Other Function PHP Version: 5.6.28 Block user comment: N Private report: N New Comment: If a hacker has access to write arbitrary PHP on a site he can simply open up the file containing the private properties and look at them. The access level of a property is not a security feature. Previous Comments: ------------------------------------------------------------------------ [2016-11-20 08:02:17] peter dot mlich at volny dot cz If it not bug, then lucky day for hackers. If i hide db name, psw dto class, hacker can easy show it only with php command :) I think, this is very stupid bug. I now need find new methode to hide password. ------------------------------------------------------------------------ [2016-11-16 10:08:43] stas@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php This is how var_dump is supposed to work. It's a debug function. ------------------------------------------------------------------------ [2016-11-16 08:49:08] peter dot mlich at volny dot cz Description: ------------ --- From manual page: http://www.php.net/function.var-dump --- var_dump ignore class permitions 'private'. Php 5.5.12. Cannot be upgraded, wamp server problem. But, its only for programing and testing. On server have top version, but not run test code there. Test script: --------------- class classDb { private $table; public $structure; function __construct($structure) { $this->table = array(1,2,3); } } $users_db = new classDb('classUser'); var_dump($users_db); // 2 var_dump($users_db->table); // 1 // 1 - Fatal error: Cannot access private property classDb::$table in C:\wamp\www\ // 2 - Show all + all in private $users_db->table :) easy for hackers ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73536&edit=1