Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59446
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.182 as permitted sender)
Message-ID: <4F80C739.2060404@gmail.com>
Date: Sun, 08 Apr 2012 01:01:13 +0200
User-Agent: Thunderbird
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
CC: PHP Developers Mailing List <internals@lists.php.net>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com> <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
In-Reply-To: <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: keisial@gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)

On 07/04/12 22:48, Yasuo Ohgaki wrote:
> Hi,
>
> The only valid reason for removing <?php from PHP script would be
> security.
>
> Since the null byte detection for fopen, remote/local script inclusion
> became much harder than before. However, it's still possible and very
> easy compare to other languages. Script execution is critical security
> problem and it's worth to make it better.
>
> If there is a switch that turns off PHP's template engine nature, PHP
> could be more secure than now.
>
> php.ini
> template_mode = on   ; INI_ALL On by default
>
> php -t foo.php   # template mode by default
> php -T foo.php  # template mode off
>
> People has option to make their code a little secure than now
> or stick with current behavior.
>
> Regards,
How does it help security?
If any, requiring '<?php' before executable code makes easier to filter
out malicious files on apps with uploads in case there's a local
inclusion vulnerability somewhere.