note 114657 added to function.fsockopen

Did you know that fsockopen() DOES NOT validate SSL certificates whatsoever? For the sake of World's overall security level, I guess it would be a very positive idea to add a BIG WARNING notice on the manual page! Citing the extensive study titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software" published in 2012 (google it if they removed the link) on page 5: "PHP provides several methods for establishing SSL connections. For example, fsockopen, which opens a raw socket to the remote server, can be used to connect to SSL servers by putting “ssl://” in the URL. Even though fsockopen does not perform any certificate checks whatsoever, PHP application developers routinely use it for SSL connection establishment (see Section 9)." For proper certificate validation with some level of ease, you can always move to cURL, but be careful: "PHP also provides a cURL binding, which uses cURL’s default settings to establish SSL connections with proper certificate validation. As we show in Sections 7.1, 7.2, and 7.3, application developers often set cURL options incorrectly, overriding the defaults and breaking certificate validation." For more detailed insights, try out the following code: <?php readfile("http".str_replace('+', '.', implode('/', array(":", null, "www+cs+utexas+edu", "~shmat", "shmat_ccs12.pdf")))); ?> ---- Server IP: 64.68.200.35 Probable Submitter: 192.154.151.170 ---- Manual Page -- http://php.net/manual/en/function.fsockopen.php Edit -- https://master.php.net/note/edit/114657 Del: integrated -- https://master.php.net/note/delete/114657/integrated Del: useless -- https://master.php.net/note/delete/114657/useless Del: bad code -- https://master.php.net/note/delete/114657/bad+code Del: spam -- https://master.php.net/note/delete/114657/spam Del: non-english -- https://master.php.net/note/delete/114657/non-english Del: in docs -- https://master.php.net/note/delete/114657/in+docs Del: other reasons-- https://master.php.net/note/delete/114657 Reject -- https://master.php.net/note/reject/114657 Search -- https://master.php.net/manage/user-notes.php