Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:45496
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.226 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:cc:subject
         :references:in-reply-to:content-type:content-transfer-encoding;
        b=SI9iZ1z9QtC70uG27ztKRcLrq9vTsxFnPDtINxPeUtcuX5KEsyVecYWtPU8qtF7bvv
         EAMvuHhSh8rpqaVitZyleBvHRXSfSnXvjcgpVRGKNQ7+oaG7OmSlFkXRra6E440MSqZu
         Pj+dy42whEeT0qWiXkJDvYkvqbG7HrYDVVxZk=
Message-ID: <4AA2535B.4070405@gmail.com>
Date: Sat, 05 Sep 2009 14:02:35 +0200
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: Andi Gutmans <andi@zend.com>
CC: internals@lists.php.net
References: <20090904081640.GA28685@joeysmith.com> <753B9AED-C850-4EBA-A828-93A2542F81A2@macvicar.net> <20090904083457.GC28685@joeysmith.com> <698DE66518E7CA45812BD18E807866CE034153BA@us-ex1.zend.net>
In-Reply-To: <698DE66518E7CA45812BD18E807866CE034153BA@us-ex1.zend.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] shebang skipping in 5.3.0
From: keisial@gmail.com (Keisial)

Andi Gutmans wrote:
> Shebang is for command line scripts (php-cli). It does not make sense to
> support it for Web server scripts. It just adds unnecessary
> code/complexity to that code base. Removing the support from php-cgi was
> really a remnant of the old days when cli and cgi were the same SAPI.
> I think we are better off this way.
>
> Andi
>   
Why doesn't is make sense? It is a legitimate usage, and if novody used
it, it wouldn't have noticed.

>
>     Case 4: PHP parser outside of web tree
>
> A very secure option is to put the PHP parser binary somewhere outside
> of the web tree of files. In /usr/local/bin, for example. The only
> real downside to this option is that you will now have to put a line
> similar to:
>
> #!/usr/local/bin/php
>   
>
> as the first line of any file containing PHP tags. You will also need
> to make the file executable. That is, treat it exactly as you would
> treat any other CGI script written in Perl or sh or any other common
> scripting language which uses the /#!/ shell-escape mechanism for
> launching itself.
>

http://php.net/manual/en/security.cgi-bin.shell.php