Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59661
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZ6G=Cphjrde3u1Mq3AAw-4yJk3s28vNe+Aybt2nGTumg@mail.gmail.com>
References: <CAGa2bXZ6G=Cphjrde3u1Mq3AAw-4yJk3s28vNe+Aybt2nGTumg@mail.gmail.com>
Date: Tue, 10 Apr 2012 10:47:05 -0700
Message-ID: <CALKFbxu-r2=8EwqKHtvHXrJecrNbCu0iOVzzQ6TOKw6Pw72c7g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Disabling PHP tags by php.ini and CLI options
From: chrisstocktonaz@gmail.com (Chris Stockton)

Hello,

On Tue, Apr 10, 2012 at 12:59 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> This is the RFC as in the title.
> Although it's not a direct security measure, but it's related
> to critical security problem prevention.
>
> If you are not familiar to how to execute arbitrary PHP code,
> steal data from RDBMS via SQL injection and LFI, it may be
> interesting.
>
> This RFC will not break any existing code. Programmers
> may keep full backward compatibility while getting better
> security.
>
> https://wiki.php.net/rfc/nophptags
>
> Please read and give comments.
> Thank you.
>
> P.S. This RFC is based on April Fool RFC written by Moriyoshi,
> but this is serious RFC.
>

I'm sorry I have read your RFC and do not mean to offend, I appreciate
the effort you spent writing it but I have to say it is really far off
from actually solving the "Problem" you want to fix. I will suggest
you use the tokenizer extension if you really must do what you are
trying to describe.

My vote on this is -1

-Chris