I have a question - does it really bother people to type the <?php tag? I
kind*a don't do that for how long, 4-5 years? Every IDE and every damn
decent code editor does that for you. Hell, they even can create a template
file for you!
Some arguments are just plain silly.

The point about file include attacks on the other hand is valid. Including
code without the <?php tag does protect from things like uploading an image
and exploiting a vurnelable include to execute the code. On the other hand
you have the problem of BC and libraries with the <?php tag everythere - I
haven't seen any real discussion about this. And beleve me, this will be
the "WTF?!".

PHp native templates are also a big factor, i personally do not use any
template engine - plain php is pretty damn good if combined with good tools
(in my case Yii framework provides great stuff to work with).

The most thing i fear that changing this will add a false sence of
security. If you include a file based on a route (witch we usually do) -
you have to check your input tripple-time and make sure it does not try to
point elsewhere. If not, the people out there will find a way to use thet
vurneability, it just would not be a. gif file, but something else. Not to
say some just configure to run any file as a PHP file.

Reply via email to