Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:27368 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 92695 invoked by uid 1010); 11 Jan 2007 16:46:32 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 92671 invoked from network); 11 Jan 2007 16:46:32 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 11 Jan 2007 16:46:32 -0000 Authentication-Results: pb1.pair.com smtp.mail=addw@phcomp.co.uk; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=addw@phcomp.co.uk; sender-id=pass Received-SPF: pass (pb1.pair.com: domain phcomp.co.uk designates 213.152.38.186 as permitted sender) X-PHP-List-Original-Sender: addw@phcomp.co.uk X-Host-Fingerprint: 213.152.38.186 freshmint.phcomp.co.uk Linux 2.5 (sometimes 2.4) (4) Received: from [213.152.38.186] ([213.152.38.186:61929] helo=mint.phcomp.co.uk) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 4C/78-42349-8A966A54 for ; Thu, 11 Jan 2007 11:45:28 -0500 Received: from addw by mint.phcomp.co.uk with local (Exim 4.66) (envelope-from ) id 1H533F-0008Ln-C6; Thu, 11 Jan 2007 16:45:17 +0000 Date: Thu, 11 Jan 2007 16:45:17 +0000 To: Christian Schneider Cc: Alain Williams , internals@lists.php.net Message-ID: <20070111164517.GF15998@mint.phcomp.co.uk> References: <20070111144144.GV15998@mint.phcomp.co.uk> <45A65B19.40900@lerdorf.com> <20070111155929.GY15998@mint.phcomp.co.uk> <45A66078.7060403@lerdorf.com> <20070111161320.GA15998@mint.phcomp.co.uk> <45A66822.6060402@cschneid.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <45A66822.6060402@cschneid.com> User-Agent: Mutt/1.4.1i Organization: Parliament Hill Computers Ltd Subject: Re: [PHP-DEV] Comments on PHP security From: addw@phcomp.co.uk (Alain Williams) On Thu, Jan 11, 2007 at 05:38:58PM +0100, Christian Schneider wrote: > Alain Williams wrote: > > One problem that I see persistently have is forgetting to declare variable 'global' > > in a function ... you only find out that something is wrong when the program > > misbehaves. Forcing variable declaration would help here. > > a) You should never use 'global' under normal circumstances. The very > few occasions where you really, really need a global variable it should > be painful and done with $GLOBALS IMHO. Mentioning 'global' and > 'teaching PHP' in the same posting makes me shiver ;-) > b) Use E_NOTICE if you are want PHP baby-sitting you by complaining > about undefined variables. Using undefined variables is a key feature > for me so I won't use E_NOTICE (in an unpatched form ;-)) but if you > insist: The option is there. No. E_NOTICE will tell you if you *use* an undefined variable, it won't tell you anything if you assign to a typeo. -- Alain Williams Linux Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 http://www.phcomp.co.uk/ Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php #include