Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117756
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.80.82.1.1\))
In-Reply-To: <5b866dcf-cbc7-4441-362b-3fa2c735dd8f@gmx.de>
Date: Thu, 19 May 2022 10:42:22 +0100
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <797F9E44-DB89-49C3-8538-913BEE6462DB@craigfrancis.co.uk>
References: <CA+XhMqw0YmvwXh_pyQgFZcWC1kO7yBrF5pkAhSzB_eHbABFnUw@mail.gmail.com>
 <62841d87.1c69fb81.82a5.8a18SMTPIN_ADDED_MISSING@mx.google.com>
 <9272E23F-F962-4023-B62D-7A70EA08E828@craigfrancis.co.uk>
 <628518bb.1c69fb81.1deb1.1bd5SMTPIN_ADDED_MISSING@mx.google.com>
 <86A3AC49-1F82-423A-9E66-B334E947E53B@craigfrancis.co.uk>
 <5b866dcf-cbc7-4441-362b-3fa2c735dd8f@gmx.de>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Subject: Re: [PHP-DEV] Early feedback on encrypted session PR
From: craig@craigfrancis.co.uk (Craig Francis)

On 18 May 2022, at 18:43, Christoph M. Becker <cmbecker69@gmx.de> wrote:
> On 18.05.2022 at 18:37, Craig Francis wrote:
>> I would hope both are very rare, but I'm still writing up reports =
about developers doing things like `file_put_contents('/tmp/' . =
$_POST['id'], $_POST['message'])`, so I don't have a lot of hope.
>=20
> Right.  And no amount of magic features implemented by a language or =
library will prevent such issues completely.  It might not have been the =
best idea to make PHP so beginner friendly.


True, but some features can catch or help limit the damage from some =
mistakes (e.g. CSP), as mistakes can be made by any developer (no one =
writes 100% secure code); and `magic_quotes` was not on that list.

Also, while I appreciate your sentiment (I feel it all too often), =
overall I prefer having loads of beginners that are learning and guided =
by the language/tooling, so they eventually become experienced =
developers for a popular language :-)

Craig