Re: Disabling PHP tags by php.ini and CLI options

Hello, On Tue, Apr 10, 2012 at 12:59 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > Hi all, > > This is the RFC as in the title. > Although it's not a direct security measure, but it's related > to critical security problem prevention. > > If you are not familiar to how to execute arbitrary PHP code, > steal data from RDBMS via SQL injection and LFI, it may be > interesting. > > This RFC will not break any existing code. Programmers > may keep full backward compatibility while getting better > security. > > https://wiki.php.net/rfc/nophptags > > Please read and give comments. > Thank you. > > P.S. This RFC is based on April Fool RFC written by Moriyoshi, > but this is serious RFC. > I'm sorry I have read your RFC and do not mean to offend, I appreciate the effort you spent writing it but I have to say it is really far off from actually solving the "Problem" you want to fix. I will suggest you use the tokenizer extension if you really must do what you are trying to describe. My vote on this is -1 -Chris