Re: [RFC] Deprecate Backtick Operator (V2)

> Le 8 oct. 2019 à 12:24, Reindl Harald (privat) <harry@rhsoft.net> a écrit : > > > > Am 08.10.19 um 11:00 schrieb Claude Pache: >> * People trying to deactivate functions executing external programs (such as >> shell_exec) using the "disable_function" ini directive, >> wondering how to deactivate the backtick operator (since there is no >> disable_operator directive) > > would you at least mind to back your claims by a simple test? > > Warning: shell_exec() has been disabled for security reasons in > /mnt/data/www/www.rhsoft.net/test.php on line 1 > > [harry@srv-rhsoft:/www/www.rhsoft.net]$ cat test.php > <?php uname?> Hi, I think you missed my point. I wasn’t claiming that there is any technical difficulty in disabling the backtick operator. I am claiming that people take time wondering how to do that, searching for the solution, and discovering that they just need to disable shell_exec. More generally, people take time in understanding the peculiarities of that uncommon feature which is the backtick operator. This is a real cost. Another example that is popping in my mind is: Does the operator supports variable interpolation (like double-quoted strings) or not (like single-quoted strings). (Please, don’t lose time in answering that question. The simple answer is: Just use shell_exec() with the type of quotes you mean, and: Tell everybody to just use shell_exec() with the type of quotes they mean.) —Claude