Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:35055
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain dynom.nl does not designate 85.92.132.6 as permitted sender)
Message-ID: <47A1831D.6040308@dynom.nl>
Date: Thu, 31 Jan 2008 09:13:17 +0100
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: internals@lists.php.net
References: <20080131011302.8B9D71F3E98@spike.porcupine.org>
In-Reply-To: <20080131011302.8B9D71F3E98@spike.porcupine.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP taint support updated
From: mark@dynom.nl (Mark van der Velden)

Wietse Venema wrote:
> I've uploaded a new version of taint support for PHP. You can find
> all the files via:
> 
>     ftp://ftp.porcupine.org/pub/php/index.html
> 
> [..]
> 
> For examples and details, see the README file, also on-line at:
> 
>     ftp://ftp.porcupine.org/pub/php/php-5.2.5-taint-20080130.README.html
> 
> I need your feedback to make this code complete. I hope to do
> several quick 1-2 month release cycles in which I collect feedback,
> fill in missing things, and adjust course until things stabilize.

I must  say I like the idea, but I'm not too fond about the error handling.

For it to help with (especially) the unexperienced programmers it should 
be enabled by default, which automatically is going to break a lot of 
websites if put in production environments.

However turning it off by default isn't going to help, most people don't 
even set their error_reporting() to a respectable setting, let alone a 
new setting.

And how does this work with the Filter ( http://docs.php.net/filter ) 
extension ?


> 
> 	Wietse
> 

- Mark