Re: Magic quotes in trunk
| From: | Rasmus Lerdorf | Date: | Thu, 18 Nov 2010 16:28:26 +0000 |
| Subject: | Re: Magic quotes in trunk | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-50360@lists.php.net to get a copy of this message | ||
On 11/18/10 8:25 AM, Johannes Schlüter wrote:
> Hi,
>
> On Thu, 2010-11-18 at 11:20 -0500, Daniel Convissor wrote:
>> Disabling magic quotes by default leads to the same confusion and security
>> issues as removing them completely.
>
> ACK
>
>> But, we can remove magic quotes
>> completely if we add a fail safe mechanism. Here are two potential
>> options:
>>
>> 1) Add taint support (http://news.php.net/php.internals/37209) and enable
>> it by default. This provides other security benefits, too.
>
> replace one magic which proved to be bad with another magic ...
Plus the performance hit of the taint patch is rather nasty.
-R