# zval taint bits

- Thread: https://externals.io/message/37183
- Original archive: https://news-web.php.net/php.internals/37183
- Started by Michael B Allen on 2008-04-22T18:29:23+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #37183 — Michael B Allen — 2008-04-22T18:29:23+00:00

URL: https://externals.io/message/37183#37183

Hi,

I saw Wietse's taint presentation at nyphp last night and I just
wanted to express my support for the feature.

It seems to me OR-ing bits together between zval fields is relatively
harmless. Clearly it will not catch everything as extensions can
introduce clean zvals that are in fact tainted (or visa versa) but I
foresee that this feature would amount to adding a very informative
warning for developers. Just as you would get a warning for trying to
call a function with the wrong parameters or divide by zero, the taint
bits can be used to teach developers as to how to properly process
their data.

Mike

PS: I am strongly against the idea of filters - the application should
output what I tell it to output and nothing else.