Re: Comments on PHP security

On Thu, Jan 11, 2007 at 05:38:58PM +0100, Christian Schneider wrote: > Alain Williams wrote: > > One problem that I see persistently have is forgetting to declare variable > > 'global' > > in a function ... you only find out that something is wrong when the program > > misbehaves. Forcing variable declaration would help here. > > a) You should never use 'global' under normal circumstances. The very > few occasions where you really, really need a global variable it should > be painful and done with $GLOBALS IMHO. Mentioning 'global' and > 'teaching PHP' in the same posting makes me shiver ;-) > b) Use E_NOTICE if you are want PHP baby-sitting you by complaining > about undefined variables. Using undefined variables is a key feature > for me so I won't use E_NOTICE (in an unpatched form ;-)) but if you > insist: The option is there. No. E_NOTICE will tell you if you *use* an undefined variable, it won't tell you anything if you assign to a typeo. -- Alain Williams Linux Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 http://www.phcomp.co.uk/ Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php #include <std_disclaimer.h>