Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72570
Return-Path: <rasmus@lerdorf.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 52958 invoked from network); 14 Feb 2014 00:01:00 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 14 Feb 2014 00:01:00 -0000
Authentication-Results: pb1.pair.com smtp.mail=rasmus@lerdorf.com; spf=permerror; sender-id=unknown
Authentication-Results: pb1.pair.com header.from=rasmus@lerdorf.com; sender-id=unknown
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.160.176 cause and error)
X-PHP-List-Original-Sender: rasmus@lerdorf.com
X-Host-Fingerprint: 209.85.160.176 mail-yk0-f176.google.com  
Received: from [209.85.160.176] ([209.85.160.176:57065] helo=mail-yk0-f176.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 1B/9D-09050-BBC5DF25 for <internals@lists.php.net>; Thu, 13 Feb 2014 19:00:59 -0500
Received: by mail-yk0-f176.google.com with SMTP id 19so21239206ykq.7
        for <internals@lists.php.net>; Thu, 13 Feb 2014 16:00:57 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to
         :cc:subject:references:in-reply-to:content-type
         :content-transfer-encoding;
        bh=4w8bdbs/oqpgPeoFN+dseSzspYFUvLxaklATGqlUeJQ=;
        b=HLm4//Bh3gz8zFZBl3ErQ7YlraEsIOxnGn2qKsq682TTVpjnfdQie0Bz+dOXDIQEDW
         D+Fzi27Fpz50qgwfEtrCrP6VrKCD9qr4bVUxb5ghKi0RbUQSxS+dfhfSya7KrhbnKKGs
         hWFVrRgC2UqMPFuc/7d8TlrWezEaGnv6jhXi4zttdbzsXKip9Lljj/fsryfFFt9uaIAE
         faKIqxi+0jr6kg7O1TTiKLhw+fMSCoTEWCK1Kw771P7rFLAwyP8q/ar4r857YLVS90yg
         3ym9aaRXJqXmEnjb8wNStSalp7PC8pbgQoZIK4ceURvPbmR1teq4TvmehohKfZZcJiqO
         jlgw==
X-Gm-Message-State: ALoCoQk1kfSZiESqdsOOLvE0PMH6zm5YiTOozl1s2BZHbYIwyibqYKdnKZlFUSjz51JcLIyAsFhW
X-Received: by 10.236.96.201 with SMTP id r49mr3853656yhf.33.1392336056924;
        Thu, 13 Feb 2014 16:00:56 -0800 (PST)
Received: from [10.8.211.163] ([65.202.74.2])
        by mx.google.com with ESMTPSA id g1sm10985784yhm.9.2014.02.13.16.00.56
        for <multiple recipients>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Thu, 13 Feb 2014 16:00:56 -0800 (PST)
Message-ID: <52FD5CB5.7070206@lerdorf.com>
Date: Thu, 13 Feb 2014 16:00:53 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com> <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com> <52FBF8F8.5040107@gmail.com> <CAGa2bXb=2fJisj90HY6ojMKmJeFFGbTwn6J1vZayzxBTLz7fBQ@mail.gmail.com> <52FCDFBD.80901@lerdorf.com> <CAGa2bXb4Ry6rwaXzjfjfLDzyhb_vgehTKTmadeSHScUCYycEqg@mail.gmail.com>
In-Reply-To: <CAGa2bXb4Ry6rwaXzjfjfLDzyhb_vgehTKTmadeSHScUCYycEqg@mail.gmail.com>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC] No PHP tags
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 02/13/2014 02:51 PM, Yasuo Ohgaki wrote:
> PHP is for the web. Web is extremely dangerous as serious professional
> attackers exploit web for money. Introducing yet another effective
> counter measure for fatal error is valuable for PHP community because
> there are vulnerable applications/codes. I cannot accept the fact that
> PHP could be much insecure than others when the same developers write
> applications...

Perhaps the biggest part of writing secure applications is understanding
your tools and your environment. The more complicated they are, the
harder it is to use them correctly. You are asking to add a brand new
high-level concept to PHP by adding a distinction between a template and
a non-template file. As far as PHP is concerned, everything is a
"template", although we never use that term. Even a plain text file with
no php tags is a template. There is no technical difference between a
file containing:

  hello world

and one containing:

  <?= "hello world\n";

They both compile to exactly:

  ECHO 'hello+world%0A'
  RETURN 1

So what is a template? What isn't a template? Is it a template simply
because it contains a PHP tag? Or is a file not a template because it
doesn't? Or is it the name of the file? What about its location? In the
end, none of these things fully define a template. A template is defined
by the context in which it is used. Changing this basic characteristic
of PHP is a really serious change and you are going to need a much
better argument than simple LFI for it to have any chance in a vote I
would suspect.

Striving to make PHP more secure for neophyte developers is always a
worthy goal, but it needs to be done in a way that doesn't make things
worse. I think this particular approach would make things worse by
needlessly complicating things.

-Rasmus