Major Security Issue: Code in bug report even kills the bug reporting page

Webmasters, I really must draw your attention to what appears to be a major flaw in PHP. The issue seems so prevalent that it even causes your bug reporting page to abort PHP parsing and very nicely print the PHP source for your page to my browser. I would call this a major security flaw. Following is the content of my attempted bug report. =================================================================== beren@datacodex.net 4.3.1 Scripting Engine parsing Redhat 7.3 - kernel 4.18-3 Short tags in comments stop execution. Password: fingle Description: ============ PHP short tags enabled in .ini Standard rpm, self-compiled - all work the same. PHP short tags in a string literal are fine until they are commented out. Once commented the scripting engine seems to no longer recognise the string literal quotes, but does parse the PHP short close tag. Surely it should not be honouring PHP open/close tags in comments?? If it should honour such tags, should it not then also honour the string delimiters?? I am aware that the short tags are not "XML compatible" but this is an example only. Code: ===== <? $xmlstring = '<?xml version="1.0" encoding="UTF-8"?>'; echo $xmlstring; // $xmlstring = '<?xml version="1.0" encoding="UTF-8"?>'; // echo $xmlstring; ?> Expected Result: ================ <?xml version="1.0" encoding="UTF-8"?> Actual Result: ============== <?xml version="1.0" encoding="UTF-8"?>'; // echo $xmlstring; ?> =================================================================== Please don't hesitate to contact me if you would like any further information. Cheers, Beren Walters Datacodex. +61 7 3844 9199