Re: [Concept] Flip relative function lookup order (global, then local)

On Aug 21 2024, at 8:03 am, Rob Landers <rob@bottled.codes> wrote: > > If this is an attack vector for your application, then fully qualified names is the way to go > (WordPress does this nearly everywhere, for example). This is an attack vector for every application and I would argue should be a real concern for the vast majority of applications out there -- any which rely on namespace-based frameworks and composer packages from untrustworthy sources. It's not just Wordpress -- literally every single PHP application that uses a publicly available framework and consumes external composer packages should be FQing their internal function calls. The natural behavior of the language shouldn't be the insecure way of doing things for the sake of maintaining BC compatibility with existing, insecure, code. Cheers, John