Re: RFC: source files without opening tag

Hi! >> I'm not sure I follow - which PHP vulnerability you are talking about? > > Local file includes. (LFI) I'm not sure I understand - where's the vulnerability? > There is a null byte protection for LFI and I really like to the protection. > It's also beneficial to other problems. However, it would not help codes > like "include $_REQUEST['var']" Don't write such code. It's like saying exec() function is a "vulnerability" in libc. You instruct PHP to run code based on user input - that's what PHP will be doing, it's not a "vulnerability" by any definition. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227