Re: Re: Disabling PHP tags by php.ini and CLI options
| From: | Lester Caine | Date: | Wed, 11 Apr 2012 09:34:43 +0000 |
| Subject: | Re: Re: Disabling PHP tags by php.ini and CLI options | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-59729@lists.php.net to get a copy of this message | ||
Stas Malyshev wrote:
Some evidence that this is an 'infamous' problem would be useful. I certainly can only see old references to the null byte problem used for LFI which was fixed in 5.3.4 but it's impossible to remove all the 'bad practices' from tutorials on the internet which create many of the problems in the first place? Certainly I can't see anything which suggests that disabling the PHP tags would do anything for LFI? I would hope that my own sites follow the right rules to prevent any problems already ... -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk// Firebird - http://www.firebirdsql.org/index.phpPHP could be stronger against LFI compare to scripting languagesas I described in previous mail. PHP is as strong as any other language right now - if you include user-supplied code, you lost, don't do it - no problem. With this RFC, infamous reputation of LFI can be removed from PHP! I see no "infamous reputation" except the wrong one you are creating right now. include with user-supplied argument is a security hole, it has nothing to do with vulnerability in PHP.