Re: Comments on PHP security

MB>> i also think something should be done here. The is_url flag does not MB>>really help. What we imho need is an ini setting that allows MB>>specifying which stream handlers to allow. And that should not include MB>>user streams. I don't see how user streams have anything to do with it - if you can define user stream, you also can run any code you wanted to run through a stream directly. If you have control over execution engine, you can run any code, stream or not stream. -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/