Re: [RFC] No PHP tags
| From: | Rasmus Lerdorf | Date: | Mon, 10 Feb 2014 08:14:20 +0000 |
| Subject: | Re: [RFC] No PHP tags | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72431@lists.php.net to get a copy of this message | ||
On 02/09/2014 11:35 PM, Yasuo Ohgaki wrote:
> Hi all,
>
> "Optional PHP tags by php.ini and CLI options" RFC has been discussed very
> long time.
>
> https://wiki.php.net/rfc/nophptags
>
> I would like to know is there anyone who would like not to have
> this. I think it's good counter measure for LFI, but you might have
> different perspective.
>
> If it is possible, I would like to address as much as opinions possible
> before voting.
>
> Are there anyone who think we should have this?
> What is the reason?
I think this would actually weaken security. Having two very different
parsing modes means that if you mix the modes and include a file in one
mode meant to be included in the other would leak the source code to the
world which is arguably a worse security issue than the sloppy coding
issue you are trying to prevent here.
-Rasmus