Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91816
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain schlueters.de from 217.114.215.10 cause and error)
Message-ID: <1458565256.1034.12.camel@kuechenschabe>
To: Chris Riley <t.carnage@gmail.com>
Cc: Rowan Collins <rowan.collins@gmail.com>, PHP internals
	 <internals@lists.php.net>
Date: Mon, 21 Mar 2016 14:00:56 +0100
In-Reply-To: <CABHuAWyfy9gvQaz94V4ajRpOzfJj=er7DOK9xMU3nNWfSTwRKg@mail.gmail.com>
References: 
	<CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
	 <CAGa2bXbjNQXwVsFmGgFVUPCFV-t2Tye+xA3MDNpA_ydjvCQ3jA@mail.gmail.com>
	 <CACNm7o9NNVFrgqeufBoDgyhE-eGQix6bZwq=XGVwsROSXVb5Ag@mail.gmail.com>
	 <56EFE897.3070804@gmail.com>
	 <CABHuAWyfy9gvQaz94V4ajRpOzfJj=er7DOK9xMU3nNWfSTwRKg@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature";
	boundary="=-a5n+0zqBh7x4McFB61jW"
Mime-Version: 1.0
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: johannes@schlueters.de (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

--=-a5n+0zqBh7x4McFB61jW
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

basically I agree to you while I see the issue, but I don't think this
is the solution (it might have been a solution if introduced 20 years
ago, making it "secure by default" and let users opt-out where needed,
but now might lead to a BC hell now)

But a comment here:

On Mon, 2016-03-21 at 12:42 +0000, Chris Riley wrote:
> 2. Relying on an ini setting for security is a bad idea: we did that
> with
> magic quotes and look how that turned out.

One can't fully compare this: magic_quotes happened before the script
started.  Thus the setting was outside the control of the script. With
this feature it is under the control of the script. You can do ini_set()
at the beginning of the script to enforce what your app needs. (while
writing libraries which are generating output in a portable way will be
harder). With magic_quotes the only way where these foreach ($_GET)
{ stripslashes } loops which often had bugs (recursion related)

johannes


--=-a5n+0zqBh7x4McFB61jW
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAABAgAGBQJW7/CJAAoJEH3sTmn8nIPXQAQH/RoqOCquHA416ZLH2In+1jhi
hmcKZMMVPklRovtkygfbMRdv3NBDCJ8hkRZbxhKcz619ELXQGn9UMhwsJTGLnyL/
sg99u/i/DYhOJoe0ZCoFggfuF533AZ68mCiK0gVW4VNPvt9Iy02ex5mCDSUi3712
0X7K2FZaQIwlHw38w65vdly9BeXaSXHG5/SaWufhc6uXWSMSKrTn2Oo/erJrAevH
Ewb0xSD/ELkUYND44KEpBbht6MvFDXBEWraVK54paAgN9F3mClek5NLotKDh2dj3
WjSzVGYK3xolvtgFTzIGk/dJZWregH42qN9BslSxxDxJjLXDzEjsQvuX8PQhS40=
=zAyz
-----END PGP SIGNATURE-----

--=-a5n+0zqBh7x4McFB61jW--