[PEPr] Comment on RFC::EvalForbiddance
| From: | Pierre-Alain Joye | Date: | Tue, 16 Aug 2005 12:57:10 +0000 |
| Subject: | [PEPr] Comment on RFC::EvalForbiddance | ||
| References: | 1 | Groups: | php.pear.dev |
| Request: | Send a blank email to pear-dev+get-39402@lists.php.net to get a copy of this message | ||
Pierre-Alain Joye (http://pear.php.net/user/pajoye) has commented on the proposal for
RFC::EvalForbiddance.
Comment:
I agree with Alan. Strong rules are somehow not as good as we think.
For eval() I like to ban it as it's always possible to replace it.
For /e and other source of problems, a 'security guide' and a per package
doc are more appropriate.
Proposal information:
http://pear.php.net/pepr/pepr-proposal-show.php?id=288
--
Sent by PEPr, the automatic proposal system at http://pear.php.net