Re: allow_url_fopen should be INI_ALL
| From: | Russell Nelson | Date: | Thu, 30 Jun 2005 04:58:16 +0000 |
| Subject: | Re: allow_url_fopen should be INI_ALL | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-17028@lists.php.net to get a copy of this message | ||
Etienne Kneuss writes:
> Russell Nelson wrote:
>
> >And you're trying to tell me that PHP's 'include' doesn't have a
> >problem??
> >
> The problem is not located on include, the problem is more general :
> "trusting user's data"
That's *also* a problem. Include's problem is a different one: that
no other language allows you to include code located on another
machine. You can't argue that an experienced programmer will not
trust user's data AND argue that an experienced programmer will
realize that 'include' happily fetches remote code, when in the
experience of said programmer no other languge's 'include' does that.
PHP's 'include' surprises people. That's evidence of a design error.
--
--My blog is at blog.russnelson.com | If you want to find
Crynwr sells support for free software | PGPok | injustice in economic
521 Pleasant Valley Rd. | +1 315-323-1241 | affairs, look for the
Potsdam, NY 13676-3213 | | hand of a legislator.