3 ms·

This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code. Perhaps a more

This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code. Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.

russss 16y ago
Sure - I'm not defending PHP. This is all the case for backwards compatibility. The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".
- nikcub 16y ago
  that is a great idea. I check if any of the 'hardened php' projects do this, and they don't