Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72431
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.192.177 cause and error)
Message-ID: <52F88A5C.4010909@lerdorf.com>
Date: Mon, 10 Feb 2014 00:14:20 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
In-Reply-To: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] No PHP tags
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 02/09/2014 11:35 PM, Yasuo Ohgaki wrote:
> Hi all,
> 
> "Optional PHP tags by php.ini and CLI options" RFC has been discussed very
> long time.
> 
> https://wiki.php.net/rfc/nophptags
> 
> I would like to know is there anyone who would like not to have
> this. I think it's good counter measure for LFI, but you might have
> different perspective.
> 
> If it is possible, I would like to address as much as opinions possible
> before voting.
> 
> Are there anyone who think we should have this?
> What is the reason?

I think this would actually weaken security. Having two very different
parsing modes means that if you mix the modes and include a file in one
mode meant to be included in the other would leak the source code to the
world which is arguably a worse security issue than the sloppy coding
issue you are trying to prevent here.

-Rasmus