Hello tlm,
j'ai décidé de copier ici un petit bout des changements prévus pour PHP6...histoire de mettre un terme à certains débats, sur "Chez moi, Jn'utilise pas addslashes, j'ai les magic_quote à on, $var au lieu de $_POST['var'] c'est plus simple, et ça marche, pas besoin de déclarer une variable avant de l'utiliser, par défaut php n'affiche pas ces warning, etc..." :
Issue: Register globals are the source of many application's security problems and cause a constant grief.
Discussion: We shortly discussed how we want to attend users on the disappearance of this functionality. We decided that if we find the setting during the startup of PHP we raise an E_CORE_ERROR which will prevent the server from starting with a message that points to the documentation. The documentation should explain why this functionality was removed, and some introduction on safe programming.
Conclusions:
- We are going to remove the functionality.
- We throw an E_CORE_ERROR when starting PHP and when we detect the register_globals setting
Issue: Magic_quotes can be cumbersome for application developers as it is a setting that can be set to on or off without any influence from within the script itself as input parameters are escaped before the script starts.
Discussion: In the same way as with the remove of the register_globals functionality, we decided that if we find the setting during the startup of PHP we raise an E_CORE_ERROR which will prevent the server from starting with a message that points to the documentation. The documentation should explain why this functionality was removed, and point the users at the input_filter extension as replacement.
Conclusions:
- We remove the magic_quotes feature from PHP.
- We throw an E_CORE_ERROR when starting PHP and when we detect the magic_quotes, magic_quotes_sybase or magic_quotes_gpc setting.
Issue: register_long_arrays and the long versions of the super globals have been deprecated since some time, and do not serve a real purpose.
Discussion: The $_GET[], $_POST[], etc style superglobals are a better alternative since they are shorter and have the same behavior. The register_long_arrays option is also off by default making it less of a problem to remove this.
Conclusions:
- We remove the register_long_arrays setting and HTTP_*_VARS globals from PHP.
- We throw an E_CORE_ERROR when starting PHP and when we detect the register_long_arrays setting.
Issue: PHP's E_STRICT error level is meant to point users to language level warnings/errors. E_STRICT is currently not part of E_ALL and thus often those E_STRICT messages will be hidden from users.
Discussion: As we want to expose the language level warnings a bit more, and because of having all error levels in E_ALL, except E_STRICT is confusing we will be adding E_STRICT to E_ALL. As the current default is E_ALL & ~E_NOTICE we will effectively turn on E_STRICT by default.
Conclusions:
Etc etc...
MAIS, malheureusement (et curieusement ) :
Issue:
Discussion:
Conclusions:
- We kill "<%" but keep "<?".
- Jani will prepare a patch that disallows mixing different open/close tags.
- We will not add "<?php =".