Re: PHP class files without <?php at the top
| From: | Ángel González | Date: | Sat, 07 Apr 2012 23:01:13 +0000 |
| Subject: | Re: PHP class files without <?php at the top | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-59446@lists.php.net to get a copy of this message | ||
On 07/04/12 22:48, Yasuo Ohgaki wrote:
> Hi,
>
> The only valid reason for removing <?php from PHP script would be
> security.
>
> Since the null byte detection for fopen, remote/local script inclusion
> became much harder than before. However, it's still possible and very
> easy compare to other languages. Script execution is critical security
> problem and it's worth to make it better.
>
> If there is a switch that turns off PHP's template engine nature, PHP
> could be more secure than now.
>
> php.ini
> template_mode = on ; INI_ALL On by default
>
> php -t foo.php # template mode by default
> php -T foo.php # template mode off
>
> People has option to make their code a little secure than now
> or stick with current behavior.
>
> Regards,
How does it help security?
If any, requiring '<?php' before executable code makes easier to filter
out malicious files on apps with uploads in case there's a local
inclusion vulnerability somewhere.