Re: Resolution for ver_export()/addslashes() encoding based script execution attack?

Hi, On 26 February 2014 22:28, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: >> I don't see how the RFC addressed the problem anyway. > > Please research how databases were fixed this issue many years ago. I don't > remember well, but I guess it was around 2005. I have a vague recollection of issues, but since there's little specific detail on this (as it pertains to PHP) publicly it's impossible for most of us to assess what the problem may be. It's even stranger to see a secret security report being RFC'd publicly, with the attendant discussions on list, which appears to go against responsible disclosure if one can put two and two together in a Eureka moment. It just spreads a lot of doubt and confusion to no end. Paddy -- Pádraic Brady http://blog.astrumfutura.com http://www.survivethedeepend.com Zend Framework Community Review Team Zend Framework PHP-FIG Representative