Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104938
MIME-Version: 1.0
References: <CAFPFaMLC6beM1Tmud-fJQ-2inUhAPXo8WAY1mvEO26jdcNos7g@mail.gmail.com>
 <37adf4e9-58f5-bfd8-fac2-94523e192d00@gmail.com> <CAESVnVpCFtR6Rt=rp_zw838+Du1in2k7=q4m_tfVmbSOry7_oA@mail.gmail.com>
 <1553526929.28717.6.camel@schlueters.de>
In-Reply-To: <1553526929.28717.6.camel@schlueters.de>
Date: Mon, 25 Mar 2019 17:38:03 +0200
Message-ID: <CAPhkiZzwbz5+8jpxSGAQb+6hmzSym4SWgar+hFkvSvPjmPo0VQ@mail.gmail.com>
To: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>
Cc: Sara Golemon <pollita@php.net>, Stanislav Malyshev <smalyshev@gmail.com>, 
	"G. P. B." <george.banyard@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Deprecate short_open_tag ini directive?
From: narf@devilix.net (Andrey Andreev)

Hi,

On Mon, Mar 25, 2019 at 5:16 PM Johannes Schl=C3=BCter
<johannes@schlueters.de> wrote:
>
> On Mo, 2019-03-25 at 09:38 -0500, Sara Golemon wrote:
> >
> > As we stand now, code using short open tags works when those tags are
> > enabled.  As we'd stand in the future, that code would not work.
> > That
> > level of BC break requires a strong justification.
>
> The code would not simply "not work" but even potentially leak to the
> client (as PHP would not treat it as code) which could leak credentials
> or other sensitive information.
>
> I still think that long-term goal should be that language behavior
> doesn't depend on ini configuration.
>

OK, so why not flip it and make it always available instead? I'm aware
of the potential XML conflict, but I've personally never seen it, so
to me that looks like the lesser evil compared to a massive BC break.

Cheers,
Andrey.