Re: PHP 5.2.0 release with "broken" input filters

Hello Stefan, On 10/23/06, Stefan Esser <sesser@hardened-php.net> wrote:

Hi, I just wanted to remind you that PHP 5.2.0 will be released with broken and inconsistent input filtering. Right now _SERVER is only passed through the input filter for apache 1 SAPI. All other SAPIs do not pass _SERVER variables through the filter.

While discussing a couple bugs related to SERVER and ENV with Ilia (empty value, leaks and JIT problems in other SAPI or CLI), we decided to disable them if no soloution has been found for these two inputs. They are still present for now, during the RC phase. The problem is to keep JIT working even when a default filter is defined, it makes little sense to initialize and duplicate these variable during the sapi filtering step.

This will be a major headache for people using ext/filter etc...

etc...? --Pierre