Re: RFC: source files without opening tag
| From: | Yasuo Ohgaki | Date: | Mon, 09 Apr 2012 19:36:26 +0000 |
| Subject: | Re: RFC: source files without opening tag | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-59535@lists.php.net to get a copy of this message | ||
Hi,
Tom's FRC is trying to introduce tag less PHP script.
However, it does not fix well known PHP vulnerability. i.e. LFI/RFI
IMHO, this change introduce more complexity and do not solve
any problem.
Making PHP tag a non mandatory would solve the well known
vulnerability and do not introduce any new function. It's also fully
compatible to existing codes.
https://wiki.php.net/rfc/nophptags
There would be many developers/administrators who would
like to be protected from code like "include $_GET['var']".
nophptags RFC protects systems from this kind of fatal
vulnerable codes.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net