Re: Security Issues

At 10:01 27/07/2001, Rasmus Lerdorf wrote:

That's also not true. Is using $foo all that better than $_GET["foo"]? For a neophyte user - most definitely. But it isn't. It's by fixing an inherent design flaw in PHP. The proposed target situation is *NOT* any more difficult to the users than the situation is today. Of course it is. $foo is conceptually simpler than $_GET["foo"]. I don't see how you can say it isn't.

Because it's a matter of taste, and different people see things different ways. Personally I find $_GET["foo"] much clearer than $foo. It tells me, beyond a reasonable doubt, where this thing is coming from. The one and only drawback I see for this method is that it's a few more keystrokes, but that's by far less important than what it gives you. As a matter of fact, if I make $_GET and its friends be implicitly global, it'd actually safe you keystrokes in many situations, and is definitely easier than teaching users about the notion of the global scope, the global statement or $GLOBALS. I *really* don't see how you can go on claiming that register_globals is not at fault, when we have so many examples, both practical past exploits and theoretical problems, directly related to it. That, on the other hand, is not a matter of taste. Zeev