Re: Run-time taint support proposal

Robert Cummings wrote:

On Tue, 2006-12-19 at 04:54 +0000, Lester Caine wrote:

Richard Lynch wrote:

On Sat, December 16, 2006 7:03 am, Lester Caine wrote:

Of cause many of us never go near the raw database calls anyway, since we are using frameworks that carry out lot of the security checks at a generic level - so I see little point adding more checks at a level that major projects do not use anyway?

Because some of us don't use the bloated frameworks, often because those who develop the bloated frameworks didn't do filtering properly, perhaps because they didn't have a taint mode to notify them that they were writing sub-standard code. :-) :-) :-)

The annoying thing is that PHP seems to be becoming the bloatware. PHP4, PHP5 incompatible versions, PHP6. Perhaps it would be nice to have a PHPLite that we can work with and add just the bits we need rather than having to manage updates which on the main add nothing to the functionality that we are actually using?

Go for it. Compile your own. Mod the source code. This is the power of open source.

If I only had to support my own servers ..... The problem is ISP's keep uploading the latest official releases and then we have to fix the faults fast :( PHP is a *SERVICE* that other people use and that service keeps getting broken - saying "Build your own" has no relevance what so ever :( Heck this is why PHP4 will never die - and I never used that. -- Lester Caine - G8HFL ----------------------------- L.S.Caine Electronic Services - http://home.lsces.co.uk Model Engineers Digital Workshop - http://home.lsces.co.uk/ModelEngineersDigitalWorkshop/ Treasurer - Firebird Foundation Inc. - http://www.firebirdsql.org/index.php