Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57737
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <60BDBA28-4E97-4C60-8E31-E34F7E4831AC@gmail.com>
References: <CAF+90c9qoyzBf+FpBxMdX0FByy5xB+7x3xi3kNxdvWX=_uz=mg@mail.gmail.com>
	<CAEZPtU7mYOB6RTHPFb8B76bPsZiFki6J5sJCMViGD7vK8Fdiyg@mail.gmail.com>
	<4F2EAF7D.9080506@thelounge.net>
	<CAORXhGKBPehGLvZsj9D4Oi2Fo4FnV+esyg_QNkuv3cO7uFn6qw@mail.gmail.com>
	<60BDBA28-4E97-4C60-8E31-E34F7E4831AC@gmail.com>
Date: Sun, 5 Feb 2012 18:09:55 +0100
Message-ID: <CAF+90c-X-CS-rTc=iCkXRQdw3WHWzwRvgJsfJz=TJi10_gAKPg@mail.gmail.com>
To: Michael Stowe <mikegstowe@gmail.com>
Cc: Tom Boutell <tom@punkave.com>, Reindl Harald <h.reindl@thelounge.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Deprecate and remove /e modifier from preg_replace
From: nikita.ppv@googlemail.com (Nikita Popov)

On Sun, Feb 5, 2012 at 5:45 PM, Michael Stowe <mikegstowe@gmail.com> wrote:
[snip]
> Perhaps another option, if it's a security concern is the ability to turn off the /e modifier, and have it off by default. This way we can protect our less experienced programmers, while keeping it available for more advanced use cases.

I think introducing an option for this will only create problems. Code
using /e will be non-portable as it depends on the ini option being
enabled. Also this way shared hosting will never disabled the modifier
because it doesn't want to break apps. And I think disabling it is
especially important for people on shared hosting, who usually are
less educated about security than people on dedicated servers.

Also: If you really want to use /e you can still call eval() inside
preg_replace_callback. This additionally has the benefit of making the
code evaluation more explicit.

Nikita