Re: Run-time taint support proposal

Hi, To me some of Ilia's arguements do not make sense. Ext/filter has the same danger of creating a false sense of security. The arguements that did make sense to me are about the issue of (un)tainting being directly tied to the context in which the variable is being used. This is a problem that many escaping frameworks face. The classic is defining a javascript variable versus html inside a template. Johannes mentioned the database versus logging etc. The only "solution" I was able to think about quickly was to define a best practice so to teach people to do the untainting as close to the variable use as possible. Actually it might even be wise to not even store the untainted version of the variable at all. $query = "select * FROM foo where bar ='".mysqli_real_escape_string($lala)."'" echo magic_escaper($lala); However I guess a lot of people love an ultra layered approach, which does tend to result in black box code, where nobody knows what is actually being escaped or not. So I guess this development style is likely dangerous anyways. regards, Lukas