Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59545
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 79914 invoked from network); 9 Apr 2012 20:28:55 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 9 Apr 2012 20:28:55 -0000
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.160.170 mail-gy0-f170.google.com  
Received: from [209.85.160.170] ([209.85.160.170:50407] helo=mail-gy0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 1E/F9-34074-686438F4 for <internals@lists.php.net>; Mon, 09 Apr 2012 16:28:55 -0400
Received: by ghbg2 with SMTP id g2so2357563ghb.29
        for <internals@lists.php.net>; Mon, 09 Apr 2012 13:28:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date
         :x-google-sender-auth:message-id:subject:to:cc:content-type
         :content-transfer-encoding;
        bh=0ABTbMJF8SqBaYKB8iq0srOzqbGPjMGt0yxch+n30dQ=;
        b=zhknKy8UTRfBa9DjEkn1RW2geByo7+CJRQQbnFAqd/G2QIie2Qf6/3l7psWtXfoX49
         8xigtpFR36vJO+eNWIbJ+H5lJ93vcxUsCeEjD18UGGJCadmKijyXs5crTO/eB5EDy6+L
         y1SNH60LJJrurEnZnHslMgeEpMGKYcZbJa8+IBj1PC4T4isMbd3yN33nnx0h/8W6IrSo
         rwBI5u95g05MPdD3eFdsDMNI9I6uy0NBDn5w3xADVUB/4uPrghsn/uYG8tLwCENZhM0V
         DZfiWVVAhOFJOdPt5iQuNEWy3WuSATVUxBubZhMZ10ZhbiIEaBgVuDSC/8Sn+JQq2CVW
         GbPA==
Received: by 10.236.190.42 with SMTP id d30mr7126378yhn.77.1334003331946; Mon,
 09 Apr 2012 13:28:51 -0700 (PDT)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.146.86.14 with HTTP; Mon, 9 Apr 2012 13:28:11 -0700 (PDT)
In-Reply-To: <4F834266.6090503@gmail.com>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
 <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
 <4F80C739.2060404@gmail.com> <CAGa2bXZSgV3bRPGMt6Esw16v3ErVMLVQy1fb8cZxdc=OokpXKg@mail.gmail.com>
 <CAL0xaBEpjhwTMFknx9nPYXqFGOqM9f2xRiBhcdb8NtPCsVL6sg@mail.gmail.com>
 <CAGa2bXaEZ1rkkQ1MTCQ8=eet9P9oAWXz-cPMe5wRhHfFJE8N8Q@mail.gmail.com>
 <CAORXhG+eg8kS9Xqyt4WdH0H5C6H5P09Uc9+U5LA0RWrs5iR5ow@mail.gmail.com>
 <CAGa2bXbtJ3ksL_iaeZ0+DGU5veKegNRS0LY1s=zrZVNwLLvt7Q@mail.gmail.com>
 <CAL0xaBGGFRqq9tkc33daKoqTNHsLNmgadkUEjJtrGGJsWfK+YQ@mail.gmail.com>
 <CAGa2bXZa=DS0YS2aL5nobGZif23qbCcAMQMaagdG2-HFffCiVg@mail.gmail.com>
 <A633CF2D7C7BED41B41F1E64F25507B806A5CDD5C0@MAILR001.mail.lan>
 <CAORXhGLa+P9_oy-hQZt6wjR5Fy1SjF9Y9ZweBdNjybkJaSc=RQ@mail.gmail.com>
 <CAGa2bXa3dGOwnFSu-DcgbM0-9z9gjYt4SrnLbR+81zSYKq+ipA@mail.gmail.com> <4F834266.6090503@gmail.com>
Date: Tue, 10 Apr 2012 05:28:11 +0900
X-Google-Sender-Auth: 86FeniurtLE_U_c1LrNV_ROAaD0
Message-ID: <CAGa2bXZJg+q3hkUU4Gdj6zn-RpJ-Q5yDroQPa2nLV_H30Q+wnQ@mail.gmail.com>
To: =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Cc: Tom Boutell <tom@punkave.com>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

2012/4/10 =C1ngel Gonz=E1lez <keisial@gmail.com>:
> On 09/04/12 21:17, Yasuo Ohgaki wrote:
>> Please do not tell me that programmer should
>> learn not to, since it's =A0not a protection but education.
> Hire a more competent programmer? If he writes such code,
> he will be completely unaware of the subtleties of XSS, or how
> SQL should be escaped, and his code is probably beyond
> "protection". You're better served by rewriting it.

I'm teaching at University on occasion.
Do you forget how you have learned languages?

>
>
>> If programmers/administrators could disable embed mode,
>> then systems will be protected from vulnerable codes.
> How do you enforce that the application you need doesn't rely on it?
>
> Note: 'education' is also forbidden as you restricted it in the
> previous question. :-)
>

Why do you insist while there is a systematic solution for it?

Regards,

--
Yasuo Ohgaki