Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81879
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.178 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU6xoSgdcyzX_L7pVWBZgOxDJMy5fDfCa3W3myzxc3=4xA@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
	<CAEZPtU6xoSgdcyzX_L7pVWBZgOxDJMy5fDfCa3W3myzxc3=4xA@mail.gmail.com>
Date: Thu, 5 Feb 2015 09:55:48 +0100
Message-ID: <CAEp07h9zA6-CS-DH_WaTK6UF3X1FmkCaY57FpKQ_kaQf8gw3QQ@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113ba080620afe050e53781f
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] script() and script_once()
From: martin.keckeis1@gmail.com (Martin Keckeis)

--001a113ba080620afe050e53781f
Content-Type: text/plain; charset=UTF-8

>
> I do not see any appealing reason to add yet another set of include
> function/ops, even less for ini settings.
>
> My reasoning is simple. Nothing we can do will prevent one or the
> other to shoot himself in each knees, many times.
>
> While trying to protect them to do include $foo where $foo ==
> "somereallybadpath", he will pretty much do the same with echo
> file_get_contents($foo);
>
> The history of php magic security issues tell me one thing, we should
> leave that to the OS level and reports error the IO layers return,
> when it fails
>

True. The time where magic $_GET or similar file inclusions was a "common
pattern" (should be) gone.
Especially since psr0/psr4/composer/... came up

I think it would be more worth to include something like this:
https://wiki.php.net/rfc/escaper

--001a113ba080620afe050e53781f--