Hi!
> "Optional PHP tags by php.ini and CLI options" RFC has been discussed very
> long time.
>
> https://wiki.php.net/rfc/nophptags
>
> I would like to know is there anyone who would like not to have
> this.
Yes. Such change would create a lot of complications on dealing with PHP
files, as syntax and parsing would be dependent on ini values, which
means one can not predict without knowing the exact environment how
specific file is going to be parsed. We already made that mistake with
short tags, and I don't think it makes sense to make it again.
We do not need to fragment PHP into two incompatible codebases, so that
some libraries only run with one set of settings and others run with
different set of settings.
> I think it's good counter measure for LFI, but you might have
> different perspective.
This is not a serious countermeasure and can not be relied on as a
security measure. The correct security is not including local files with
unsanitized names and use open_basedir if required.
--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227