Re: Run-time taint support proposal

From: Date: Wed, 20 Dec 2006 05:23:23 +0000
Subject: Re: Run-time taint support proposal
References: 1  Groups: php.internals 
Request: Send a blank email to internals+get-27136@lists.php.net to get a copy of this message
On 20-Dec-06, at 12:08 AM, Andi Gutmans wrote:
Static analysis won't work well enough in PHP.
It can get you 70-80% there though, without touching the engine.
Btw, I don't see someone doing that foreach and using untaint() being different from someone not filtering their input.
People really should not ignore E_NOTICE, especially about undefined vars. At yet very few applications can truly say that they are E_NOTICE free. Most people just drop the error_reporting level or use error blocking operator. Ilia Alshanetsky

« previous php.internals (#27136) next »