On 02/09/2014 11:35 PM, Yasuo Ohgaki wrote:
> Hi all,
>
> "Optional PHP tags by php.ini and CLI options" RFC has been discussed very
> long time.
>
> https://wiki.php.net/rfc/nophptags
>
> I would like to know is there anyone who would like not to have
> this. I think it's good counter measure for LFI, but you might have
> different perspective.
>
> If it is possible, I would like to address as much as opinions possible
> before voting.
>
> Are there anyone who think we should have this?
> What is the reason?
I think this would actually weaken security. Having two very different
parsing modes means that if you mix the modes and include a file in one
mode meant to be included in the other would leak the source code to the
world which is arguably a worse security issue than the sloppy coding
issue you are trying to prevent here.
-Rasmus