Re: Re: PHP taint support: first results

Wietse Venema wrote: > Rasmus Lerdorf: >> Consider very common (abbreviated) code like this: >> >> $user_data = $_REQUEST['data']; >> switch($output_format) { > > Question: where is the output format feature documented? > > Once I know the output format is not HTML, then I know > that applying HTML-style restrictions is not appropriate. > > I did search around but came up empty handed. That's just an example. People building REST-based web services will typically include an output format parameter. Or they determine the output format based on other criteria. It's completely up to the script author which output format he wants to use and how he wants to make that decision. -Rasmus