Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:106553
MIME-Version: 1.0
References: <CAFPFaML19B_RehrUQLEy_oFae-H5r3+BpUGg=GF1js83cJpJqQ@mail.gmail.com>
 <CAEYWF=4cx_i=3rCfFKeBT0Jq0e4=P0PeY2wd6YEwog_VdA1+Dg@mail.gmail.com>
 <CAJHtznzie34C92y2nTRXxhD99FEW-5hmruVatsrLDHcAKvTccQ@mail.gmail.com>
 <CAEYWF=7S2SxzxU+TzRV0Rc7FNMvyZBkAENVTNbZKqrs71Uyijw@mail.gmail.com>
 <000001d54e5a$02ac09f0$08041dd0$@roze.lv> <2b5588d6-d667-321f-22f1-46a22bb797c5@korulczyk.pl>
 <000001d54ea3$eb3480a0$c19d81e0$@roze.lv> <ad6b9615-372d-69ba-9ca5-e8fa554c5aea@korulczyk.pl>
 <000301d54ead$b43e7b00$1cbb7100$@roze.lv> <59378662-77ca-0779-10cb-c25acf1b45ef@korulczyk.pl>
In-Reply-To: <59378662-77ca-0779-10cb-c25acf1b45ef@korulczyk.pl>
Date: Mon, 12 Aug 2019 01:29:21 -0700
Message-ID: <CAKOpQSySEqE4VR+b0Twp4NxZMa+ruEYTbV7qr38Tcw8wqobH2A@mail.gmail.com>
To: Robert Korulczyk <robert@korulczyk.pl>
Cc: Reinis Rozitis <r@roze.lv>, PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000dd0f1b058fe75239"
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecate PHP's short open tags, again
From: kris.craig@gmail.com (Kris Craig)

--000000000000dd0f1b058fe75239
Content-Type: text/plain; charset="UTF-8"

On Fri, Aug 9, 2019 at 6:25 AM Robert Korulczyk <robert@korulczyk.pl> wrote:

> > Disabling short tags now is done with "an explicit directive" (there has
> to be a specific ini file with a specific setting 'short_open_tag = 0').
> > Isn't this the same "situation when you create a separate file with an
> explicit directive"?
>
> No, it's not. `php.ini` is outside of project responsibility - as a
> developer you don't really configure this in any way, your application does
> not
> have any explicit directive to disable/enable short open tags. You just
> accidentally using feature that could lead to code leak.
> In your example with `engine` directive you explicitly disable PHP engine
> by creating dedicated file for that purpose - there is no way do to this by
> accident and then does not notice it.
>
>
> > If a coder (or IDE) has written '<?', '<%'  or by accident any other tag
> unless tested the effect (a part of code not being parsed/executed) will be
> > exactly the same if the feature suddenly disappeared (unless the
> additional checks in the 'v2 RFC' which on the other hand would make the
> engine a
> > tiny bit slower but probably have to be implemented to avoid such
> accidents).
>
> At least the this behavior will be consistent - you will not have cases
> when code works fine on one environment and leak on another.
>
>
> Regards,
> Robert Korulczyk
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
So far, the RFC only has 55% support, which means it's not going to pass
this time, anyway, unless there's a vote shift in the next 8 days.

--000000000000dd0f1b058fe75239--