Re: Re: Disabling PHP tags by php.ini and CLI options
| From: | Stas Malyshev | Date: | Wed, 11 Apr 2012 05:25:03 +0000 |
| Subject: | Re: Re: Disabling PHP tags by php.ini and CLI options | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-59708@lists.php.net to get a copy of this message | ||
Hi!
> I'm sure you have seen the same code in JSON hijack countermeasure.
>
> while(1){}
I think you misunderstood what I means. What I meant is you can inject
code without <? the same way you can inject code with <?, so where's the
improvement?
kill() function would be just an example of code being injected by
hostile third party (intent on killing your server, presumably). If I
can inject it with <?, what prevents me from injecting without <? ?
--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227