Re: RFC: source files without opening tag
| From: | Luke Scott | Date: | Tue, 10 Apr 2012 03:39:52 +0000 |
| Subject: | Re: RFC: source files without opening tag | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-59612@lists.php.net to get a copy of this message | ||
> It's easy to say "write correct code. don't write stupid code", but
> we cannot enforce it in real world.
>
> I'm concerning both arbitrarily script execution and arbitrarily
> information disclosure. Good example is LFI and SQL injection
> attack.
Uh yeah there is. I won't employ someone who insists on writing code
like this. I dont know anyone who will. I also wont use libraries that
have code like this. Not only is it insecure but an improper use of
these constructs/functions.
All this has nothing to do with Tom's RFC. It has nothing to do with
having a <?php tag or not.
I would actually suggest that require/include stop supporting remote
files all together. But that can be a different RFC.
This "security problem" isn't a problem with common sense.
Luke