4 ms·
Ah, gotcha. So, treat them like they're "tainted", in perl parlance. I was thinking that remark was intended more along the lines of "never use $_GET and $_POS
by EvilTerran 13y ago
Ah, gotcha. So, treat them like they're "tainted", in perl parlance.
I was thinking that remark was intended more along the lines of "never use $_GET and $_POST directly, only ever access them via something like Symfony's sfWebRequest::getGetParameter/getParameterHolder/etc", which struck me as a bit overzealous as such rules go.
- krapp 13y agoYeah, just make sure somewhere you're doing all the checking (type, length, character set, providing sane defaults, etc.) that other languages probably do for you. Because users are evil and want to destroy you and PHP is only too happy to help them... :\
- EvilTerran 13y agoYeah, I often feel like PHP is trying to destroy me. / used Haskell at uni, loved it // first job in the real world is... web dev, on a sprawling legacy PHP codebase, with no documentation or tests /// I miss my static guarantees :(