Re: Re: [RFC] No PHP tags
Yasuo Ohgaki wrote:
Let me rephrase. Does anyone argue that the fact
Local script inclusion is *much grater security threat* than local script
expose.
Since I'm happy to make my scripts available anyway. Exposure is irrelevant. Hackers can see how the code is constructed and see that there is little point trying to attack me via local script inclusion simply because I do not allow any uploaded files to be used within the live code. And
But what I don't understand here is why only pure code pages are a risk? Many of the included files on the sites I'm managing have embedded html so they need the tags to be active. Header and footer blocks are more html than php and use <?= ?> tags to embed variable data along with (now) <?php ?> for the heavier processes. Surely it's just as easy to be naughty inside a block as it is simply providing a hacked page of script? That is if you have unsafe code ... surely switching off just one '<?php' will only happen on sites that are already safe anyway?
--
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk
Thread (37 messages)