Re: Security Issues

At 13:44 7/28/2001, Zeev Suraski wrote the following: -------------------------------------------------------------- >At 05:08 27/07/2001, php4@developersdesk.com wrote: >>Addressed to: Rasmus Lerdorf <rasmus@php.net> >> <php-dev@lists.php.net> >> >>> Or you can simply stop these people from using PHP which is another >>> effect turning off register_globals will have. Sorry, but that doesn't hold water. >>> Java does not have this problem because Java is so complex that this >>> same set of users can not program in Java. Fixing this problem by >>> making PHP more complex and eliminating these "problem" users is a bad >>> idea as far as I am concerned. >> >> >>YES!! > >NO!! :) Saying people would stop using PHP (or won't get started) because of this change >is a gross exaggeration. IMHO, the one and only issue at hand here is downwards compatibility, and >not usability or ease of use, not even a bit. register_globals had no effect on my decision to learn PHP, or continue using it. [...] >There are a hell of a lot more cases where using uninitialized variables is entirely secure, >than cases where it's not. As a 'purist' coming from C background, I'd always >initialize variables. PHP users would not. I had zero C knowledge when I started learning PHP, and I always initialize variables in PHP. >BTW, I'm just being argumentative here. I personally think that having E_NOTICE on is a >very good idea, and that apps should be E_NOTICE-clean. A great deal of PHP programmers will not >agree with me, though, so I haven't made up my mind on whether I support changing this default >or not. I agree with you. cynic@mail.cz ------------- And the eyes of them both were opened and they saw that their files were world readable and writable, so they chmoded 600 their files. - Book of Installation chapt 3 sec 7