Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59585
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYhS9QCWarTKyBgv3Vnh8D8S=+Vic-XQZm0w6dqrkpf6A@mail.gmail.com>
References: <CAORXhGJwmbjw3Zze3+-oFA2Mb_Z-2owVESraNMMs57RzjRRMbA@mail.gmail.com>
	<CAGa2bXbjiNMv0g6BBZkuTtUe66gz-p8mQxRk+_0fisiJUADRgQ@mail.gmail.com>
	<CAGa2bXYhS9QCWarTKyBgv3Vnh8D8S=+Vic-XQZm0w6dqrkpf6A@mail.gmail.com>
Date: Tue, 10 Apr 2012 03:07:38 +0300
Message-ID: <CAL0xaBEmUbkoXmadp17JHovhLGPFRxhQ7er0RU9GJB6=LrH=gw@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=e89a8f235a292a562d04bd47e9c3
Subject: Re: [PHP-DEV] RFC: source files without opening tag
From: arvids.godjuks@gmail.com (Arvids Godjuks)

--e89a8f235a292a562d04bd47e9c3
Content-Type: text/plain; charset=UTF-8

I have a question - does it really bother people to type the <?php tag? I
kind*a don't do that for how long, 4-5 years? Every IDE and every damn
decent code editor does that for you. Hell, they even can create a template
file for you!
Some arguments are just plain silly.

The point about file include attacks on the other hand is valid. Including
code without the <?php tag does protect from things like uploading an image
and exploiting a vurnelable include to execute the code. On the other hand
you have the problem of BC and libraries with the <?php tag everythere - I
haven't seen any real discussion about this. And beleve me, this will be
the "WTF?!".

PHp native templates are also a big factor, i personally do not use any
template engine - plain php is pretty damn good if combined with good tools
(in my case Yii framework provides great stuff to work with).

The most thing i fear that changing this will add a false sence of
security. If you include a file based on a route (witch we usually do) -
you have to check your input tripple-time and make sure it does not try to
point elsewhere. If not, the people out there will find a way to use thet
vurneability, it just would not be a. gif file, but something else. Not to
say some just configure to run any file as a PHP file.

--e89a8f235a292a562d04bd47e9c3--