Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59443
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
Date: Sun, 8 Apr 2012 05:48:27 +0900
Message-ID: <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
To: Tom Boutell <tom@punkave.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

The only valid reason for removing <?php from PHP script would be
security.

Since the null byte detection for fopen, remote/local script inclusion
became much harder than before. However, it's still possible and very
easy compare to other languages. Script execution is critical security
problem and it's worth to make it better.

If there is a switch that turns off PHP's template engine nature, PHP
could be more secure than now.

php.ini
template_mode = on   ; INI_ALL On by default

php -t foo.php   # template mode by default
php -T foo.php  # template mode off

People has option to make their code a little secure than now
or stick with current behavior.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net



2012/4/7 Tom Boutell <tom@punkave.com>:
> Now that the flamewar has died down a little I'd like to try to have a
> civil discussion about this idea - *without* my admittedly
> inflammatory suggestion to kill <?php altogether.
>
> So here is what I am seriously suggesting:
>
> * The default behavior doesn't change. The parser starts out in HTML mode.
>
> * If the CLI sees a .phpc file extension, the parser starts out in PHP
> mode (no opening <?php is required). It is still possible to shift
> into HTML mode after that with ?>.
>
> * If a require/include statement sees a .phpc file extension, the
> parser starts out in PHP mode.
>
> * If mod_php and FPM are able to see the path (I'm honestly not sure
> if they can or not), they look for .phpc as their indication to start
> out in PHP mode. If that's not possible then new options are defined
> to allow Apache to be configured to tell mod_php and/or FPM to do the
> right thing based on mime types etc.
>
> This way .php continues to behave exactly as it does today, and can
> interoperate smoothly with code that uses .phpc. .phpc can require
> .php and vice versa. They are friends.
>
> Thoughts?
>
> --
> Tom Boutell
> P'unk Avenue
> 215 755 1330
> punkave.com
> window.punkave.com
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>