Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Check for military time Date: Sun, 1 Nov 2015 16:51:11 +0100 Lines: 64 Message-ID: <563634EF.7080601@arnowelzel.de> References: <1874827.QbCUPLQBcH@PointedEars.de> <562F77B7.1050001@arnowelzel.de> <8737wvd78w.fsf@ahungry.com> <5631e20e$0$23743$e4fe514c@news.xs4all.nl> <87y4elb05f.fsf@ahungry.com> <5633C02A.60502@arnowelzel.de> <5635F049.3020000@arnowelzel.de> <56361577.8080409@arnowelzel.de> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Trace: individual.net wS5kKzY4JBdBrtrnOMTI2ggaKtJQGfjNNl3xUmSVxBYoG6zNyP Cancel-Lock: sha1:w7cJJcUatH5vuYIZf6LuaOWDIRU= In-Reply-To: Xref: csiph.com comp.lang.php:15830 Jerry Stuckle schrieb am 2015-11-01 um 15:05: > On 11/1/2015 8:36 AM, Arno Welzel wrote: >> Jerry Stuckle schrieb am 2015-11-01 um 14:27: [...] >> And it was you bringing up this: >> >> "But to answer your question - the problem is your test can cause a >> fatal error, potentially displaying internal information to a user. >> This information could be used to hack the system." >> >> And this is something which will NEVER happen in a production system. A >> production system MUST NOT display errors to a user. >> > > That's true. And using closing tags is one more step which can prevent it. You don't get my point: a production system MUST NOT display errors to a user - regardless what caused the error. >> You can not be sure that errors will NEVER happen - even when you end >> all your scripts with closing tags. Many things can go wrong during >> runtime - e.h. database connections may not be available etc.. And for >> all these cases you MUST ensure that users will NEVER see error messages >> with internal details about the production system. And yes, this is >> possible, even for PHP. >> > > No, you cannot be sure errors will never happen. You also cannot be > sure that your php.ini file will never be changed. It is NEVER possible > to have 100% assurance that error messages will never be displayed. But > using closing tags is one more level of protection against it happening. Wrong - mission critical configuration settings MUST stay as defined. Otherwise the responsible persons should better look for another job. >> So even bringing up the possibility that a *user* of a system may see >> error messages with internal information shows me that you either don't >> have experience in how to configure and run production systems or you >> assume that everybody here is just a hobbyist and does not understand >> the difference between a development system and production system. >> >> > > The fact you don't consider it possible proves you don't have the > necessary experience to work on a production system. You don't even > rate hobbyist level. You're nothing more than a troll. I don't know what you consider "professional" - but I wouldn't consider stupid things like allowing internal error messages to be disaplayed to the user on a production system just because one of the developers created a formal error in one of his scripts and putting them to the production system without testing it. I would also never let a software developer touch the php.ini of a production system without doing a review or even let anyone put scripts to production without testing at all. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de http://fahrradzukunft.de