Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72847
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYBqNX8e+sSpoF-AoJCpKY0paQaxMSi0N5rxHOiz1VpQg@mail.gmail.com>
References: <CAGa2bXYO=Q3pmYKYOt0qudFtzimrXitJoLcB4KZ80MYJ-nJo0A@mail.gmail.com>
	<CAF+90c9umjqfiW3780hPjk_LpbyV=fT2t=bXZxWhiSDN-yuiuA@mail.gmail.com>
	<CAGa2bXZcs-zq7afbY9dqvOcnQ0q1MAC0muO3VNSfxzMnL4_hCg@mail.gmail.com>
	<530C3C7B.8080907@sugarcrm.com>
	<CAGa2bXYyxrLXxT812=s_s7zB+En1mfAJy9du90+Yt7OPZYjdvA@mail.gmail.com>
	<530C77F8.2060809@sugarcrm.com>
	<1393328380.5233.45.camel@guybrush>
	<CAGa2bXbNKxNN-j1LoisnvGsUbxk-6ZqNG87zF3BUg1LEHUYcgw@mail.gmail.com>
	<530DADC7.2070302@lsces.co.uk>
	<CAGa2bXYFBocCPYXZxznWj8-y+O8ME9vHKC4BcG=UQqC6rocRjg@mail.gmail.com>
	<530DDEC6.9010901@lsces.co.uk>
	<CAGa2bXYBqNX8e+sSpoF-AoJCpKY0paQaxMSi0N5rxHOiz1VpQg@mail.gmail.com>
Date: Thu, 27 Feb 2014 22:22:47 +0000
Message-ID: <CALwr1GkQb94eSmoLO0n4miFcdtkx66A1ytyExsoUWgk_tChN8w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Lester Caine <lester@lsces.co.uk>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Resolution for ver_export()/addslashes() encoding based
 script execution attack?
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

On 26 February 2014 22:28, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> I don't see how the RFC addressed the problem anyway.
>
> Please research how databases were fixed this issue many years ago. I don=
't
> remember well, but I guess it was around 2005.

I have a vague recollection of issues, but since there's little
specific detail on this (as it pertains to PHP) publicly it's
impossible for most of us to assess what the problem may be. It's even
stranger to see a secret security report being RFC'd publicly, with
the attendant discussions on list, which appears to go against
responsible disclosure if one can put two and two together in a Eureka
moment. It just spreads a lot of doubt and confusion to no end.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative