Re: Run-time taint support proposal

On Tue, 2006-12-19 at 04:54 +0000, Lester Caine wrote: > Richard Lynch wrote: > > On Sat, December 16, 2006 7:03 am, Lester Caine wrote: > >> Of cause many of us never go near the raw database calls anyway, since > >> we are using frameworks that carry out lot of the security checks at a > >> generic level - so I see little point adding more checks at a level > >> that > >> major projects do not use anyway? > > > > Because some of us don't use the bloated frameworks, often because > > those who develop the bloated frameworks didn't do filtering properly, > > perhaps because they didn't have a taint mode to notify them that they > > were writing sub-standard code. > > :-) :-) :-) > > The annoying thing is that PHP seems to be becoming the bloatware. PHP4, > PHP5 incompatible versions, PHP6. Perhaps it would be nice to have a > PHPLite that we can work with and add just the bits we need rather than > having to manage updates which on the main add nothing to the > functionality that we are actually using? Go for it. Compile your own. Mod the source code. This is the power of open source. Cheers, Rob. -- .------------------------------------------------------------. | InterJinn Application Framework - http://www.interjinn.com | :------------------------------------------------------------: | An application and templating framework for PHP. Boasting | | a powerful, scalable system for accessing system services | | such as forms, properties, sessions, and caches. InterJinn | | also provides an extremely flexible architecture for | | creating re-usable components quickly and easily. | `------------------------------------------------------------'