Re: Re: PHP-4.0.7RC1

From:	Zeev Suraski	Date:	Sat, 18 Aug 2001 09:36:02 +0000
Subject:	Re: Re: PHP-4.0.7RC1
References:	1 2 3 4 5	Groups:	php.qa
Request:	Send a blank email to php-qa+get-3523@lists.php.net to get a copy of this message

At 03:35 18-08-01, Richard Lynch wrote:

- It's almost always harmless, especially after we change the default value of register_globals to off. It's two sides to the same coin, really:

Nope, it's not a coin really. The two alternatives are far from being equivalent.

If E_ALL was on, there wouldn't *BE* any un-initialized variables for GPC data to tromp on in the first place. I'd rather have E_ALL on and leave register_globals alone by default.

We've already been in that discussion. It doesn't work that way - register_globals set to off gives the full answer to the problem, whereas E_ALL gives a very partial, inferior solution. Since register_globals is being phased out, the reason to turn E_ALL goes down significantly. register_globals=off includes all the security benefits benefits of error_reporting=E_ALL, but clearly not the other way around. Zeev