note 110180 rejected from functions.variable-functions by googleguy
| From: | googleguy@php.net | Date: | Fri, 28 Sep 2012 09:15:02 +0000 |
| Subject: | note 110180 rejected from functions.variable-functions by googleguy | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-191057@lists.php.net to get a copy of this message | ||
Note Submitter: bogus at example dot com
----
This feature of php is a god-send for code obfuscators, and in use by people hiding backdoors in
sites. It makes it very difficult to search for inserted code, allowing that there may be no php
function names visible in the code at all.
I'd like to see a way to disallow use of this feature, and/or a way to make it produce a
warning when used, so that its use may be audited.
Example code deliberately not provided.