Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13198

Re: Nested PHP

Path csiph.com!usenet.pasdenom.info!aioe.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From Arno Welzel <usenet@arnowelzel.de>
Newsgroups comp.lang.php
Subject Re: Nested PHP
Date Mon, 17 Mar 2014 15:26:52 +0100
Lines 36
Message-ID <5327062C.6010706@arnowelzel.de> (permalink)
References <1lgvceg.n1ow4ilfgsk0N%adrian@poppyrecords.invalid.invalid> <5313461D.70508@arnowelzel.de> <lf1pjs$nlb$1@news.albasani.net>
Mime-Version 1.0
Content-Type text/plain; charset=UTF-8
Content-Transfer-Encoding 7bit
X-Trace individual.net 8Iw+ezsghWphBHQlrZ7UkQPPCOD60eqtP4VpxO6306rldwdzzt
Cancel-Lock sha1:WVGL6seDolnOe1n3X2GlRmQJdWY=
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
In-Reply-To <lf1pjs$nlb$1@news.albasani.net>
Xref csiph.com comp.lang.php:13198

Show key headers only | View raw

Am 03.03.2014 12:38, schrieb The Natural Philosopher:

> On 02/03/14 14:54, Arno Welzel wrote:
>> Adrian Tuddenham, 2014-02-10 21:24:
>>
[About eval()]
>> I recommend to think about what you want to solve and if it is really
>> neccessary to create "dyanamic" PHP on the fly.
>>
> Nice thing about evalled code is that you can stick it in a database..

You call it "nice" to put *code* in a database? I would call it an ugly
hack.

I know, some products like vBulletin do this in production environments
- they put all their plugins and some other stuff in the database.

But this does not mean this is "nice" nor even something you want. Even
WordPress does not try to put code into the database ;-)

This is only a hack for situations where a plugin installer in the
administrative backend may not be able to write the files.

Some may this even call more "secure" since you can set the folder
permissions more restrictive. Some may call this more "comfortable"
since you don't need to give the web server permissions to write to the
document root. But in the end - it doesn't matter if an attacker is able
to overwrite files or overwrite database content, and securing the
database is not as easy as protecting the filesystem.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 20:24 +0000
  Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 15:56 -0500
    Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 21:44 +0000
      Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 16:51 -0500
        Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 08:14 -0600
          Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 09:27 -0500
            Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 18:41 -0600
              Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 20:03 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-12 10:33 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:30 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 12:52 +0000
                Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-12 13:11 +0000
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:55 +0000
                Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-13 12:02 -0600
                Re: Nested PHP Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2014-02-12 12:14 +0000
      Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-10 22:09 +0000
      Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-10 23:23 +0100
      Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-10 22:27 +0000
      Re: Nested PHP Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-02-11 09:30 +1100
      Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-10 23:06 +0000
        Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 20:46 -0500
          Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 10:11 +0000
            Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 11:17 +0000
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 12:01 +0000
                Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 12:45 +0000
                Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-11 13:55 +0100
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 13:29 +0000
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 17:24 +0000
            Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 08:15 -0500
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 10:10 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:24 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:33 -0500
                Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:26 +0000
            Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 14:41 +0000
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:53 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:26 -0500
      Re: Nested PHP bill <william@TechServSys.com> - 2014-02-11 07:12 -0500
  Re: Nested PHP richard <noreply@example.com> - 2014-02-12 09:33 -0500
    Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:47 +0000
      Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-13 05:01 -0800
        Re: Nested PHP Evan Platt <evan@theobvious.espphotography.com.invalid> - 2014-02-14 07:19 -0800
          Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-14 10:43 -0800
  Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-02 15:54 +0100
    Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-03-02 18:10 +0000
    Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-03 11:38 +0000
      Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-17 15:26 +0100
        Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-17 10:52 -0400
        Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 15:33 +0000
          Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-17 17:10 -0500
            Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 23:01 +0000
              Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-18 00:31 +0100
                Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-18 13:10 +0000
  Re: Nested PHP Gabe <usenet@moojuice.net> - 2014-03-17 15:18 +0000

csiph-web