> Or someone can send you a URL that points to your dev server and contains a payload. That is theoretically possible, though what they would be able to do is

> Or someone can send you a URL that points to your dev server and contains a payload. That is theoretically possible, though what they would be able to do is to deal damage to my development install (if I don't to CSRF protection on POST operations) or they could potentially hijack my current session on my development system, which, too I don't deem too critical. > who uses shared hosting where display_errors is enabled by default init_set('display_errors', 0); Even on a shared host you can turn display_errors off. > There is no good reason PHP should be displaying this information unsanitized. I agree, especially because they already do some escaping of their own errors (and consequently don't escape while running in the CLI SAPI)