Re: RFC: source files without opening tag

From: Date: Mon, 09 Apr 2012 19:36:26 +0000
Subject: Re: RFC: source files without opening tag
References: 1 2 3 4 5 6 7 8 9 10  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message 
Hi,

Tom's FRC is trying to introduce tag less PHP script.
However, it does not fix well known PHP vulnerability. i.e. LFI/RFI
IMHO, this change introduce more complexity and do not solve
any problem.

Making PHP tag a non mandatory would solve the well known
vulnerability and do not introduce any new function. It's also fully
compatible to existing codes.

https://wiki.php.net/rfc/nophptags

There would be many developers/administrators who would
like to be protected from code like "include $_GET['var']".
nophptags RFC protects systems from this kind of fatal
vulnerable codes.

Regards,

--
Yasuo Ohgaki
[email protected]

Thread (109 messages)

« previous php.internals (#59535) next »