Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59586
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAL0xaBEmUbkoXmadp17JHovhLGPFRxhQ7er0RU9GJB6=LrH=gw@mail.gmail.com>
References: <CAORXhGJwmbjw3Zze3+-oFA2Mb_Z-2owVESraNMMs57RzjRRMbA@mail.gmail.com>
 <CAGa2bXbjiNMv0g6BBZkuTtUe66gz-p8mQxRk+_0fisiJUADRgQ@mail.gmail.com>
 <CAGa2bXYhS9QCWarTKyBgv3Vnh8D8S=+Vic-XQZm0w6dqrkpf6A@mail.gmail.com> <CAL0xaBEmUbkoXmadp17JHovhLGPFRxhQ7er0RU9GJB6=LrH=gw@mail.gmail.com>
Date: Tue, 10 Apr 2012 09:19:13 +0900
Message-ID: <CAGa2bXb2D2_p57ULuibBPk-2bexvQ3H3N1gq4Vy4wsrUmiFRGg@mail.gmail.com>
To: Arvids Godjuks <arvids.godjuks@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] RFC: source files without opening tag
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

2012/4/10 Arvids Godjuks <arvids.godjuks@gmail.com>:
> I have a question - does it really bother people to type the <?php tag? I
> kind*a don't do that for how long, 4-5 years? Every IDE and every damn
> decent code editor does that for you. Hell, they even can create a template
> file for you!
> Some arguments are just plain silly.
>
> The point about file include attacks on the other hand is valid. Including
> code without the <?php tag does protect from things like uploading an image
> and exploiting a vurnelable include to execute the code. On the other hand
> you have the problem of BC and libraries with the <?php tag everythere - I
> haven't seen any real discussion about this. And beleve me, this will be
> the "WTF?!".

I agree.

Therefore, current behavior is the default. If newer code written with a
little care, the code is compatible for both embedded and non-embedded
modes. Those who are not willing to write opening TAG, it is possible a
single ini_set() or command line option, too.

https://wiki.php.net/rfc/nophptags

Comments are welcome.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

>
> PHp native templates are also a big factor, i personally do not use any
> template engine - plain php is pretty damn good if combined with good tools
> (in my case Yii framework provides great stuff to work with).
>
> The most thing i fear that changing this will add a false sence of
> security. If you include a file based on a route (witch we usually do) -
> you have to check your input tripple-time and make sure it does not try to
> point elsewhere. If not, the people out there will find a way to use thet
> vurneability, it just would not be a. gif file, but something else. Not to
> say some just configure to run any file as a PHP file.