Disabling PHP tags by php.ini and CLI options
| From: | Yasuo Ohgaki | Date: | Tue, 10 Apr 2012 07:59:42 +0000 |
| Subject: | Disabling PHP tags by php.ini and CLI options | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-59626@lists.php.net to get a copy of this message | ||
Hi all,
This is the RFC as in the title.
Although it's not a direct security measure, but it's related
to critical security problem prevention.
If you are not familiar to how to execute arbitrary PHP code,
steal data from RDBMS via SQL injection and LFI, it may be
interesting.
This RFC will not break any existing code. Programmers
may keep full backward compatibility while getting better
security.
https://wiki.php.net/rfc/nophptags
Please read and give comments.
Thank you.
P.S. This RFC is based on April Fool RFC written by Moriyoshi,
but this is serious RFC.
--
Yasuo Ohgaki
yohgaki@ohgaki.net