Re: Comments on PHP security
| From: | Christian Schneider | Date: | Thu, 11 Jan 2007 16:38:58 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27367@lists.php.net to get a copy of this message | ||
Alain Williams wrote:
> One problem that I see persistently have is forgetting to declare variable 'global'
> in a function ... you only find out that something is wrong when the program
> misbehaves. Forcing variable declaration would help here.
a) You should never use 'global' under normal circumstances. The very
few occasions where you really, really need a global variable it should
be painful and done with $GLOBALS IMHO. Mentioning 'global' and
'teaching PHP' in the same posting makes me shiver ;-)
b) Use E_NOTICE if you are want PHP baby-sitting you by complaining
about undefined variables. Using undefined variables is a key feature
for me so I won't use E_NOTICE (in an unpatched form ;-)) but if you
insist: The option is there.
- Chris