Post by @alice@marrow.haus

2023-05-25 12:14 UTC

@ramsey@phpc.social So… have they fixed register_globals yet? If https://www.php.net/parse_str still contaminates the calling scope on use, even when passing in an array to populate, the answer would seem to be "no". Older example, mysqli_real_escape_string exists. When there was that entire opportunity to finally remove the cruft during the mysql→mysqli API update. It's rare I've walked into a language support channel, asked a question, and has a moderator explicitly tell me it's because the language is bad.

Replies (2)

@ramsey@phpc.social 2023-05-25 12:15

@alice@marrow.haus Read the docs you just linked to. “As of PHP 8.0.0, the result parameter is mandatory.”

Open ##2960159
@adorkable@infosec.exchange 2023-05-25 12:49

@alice@marrow.haus PHP has a *very* long deprecation path, because the goal is to have backwards compatibility as much as possible going through 2 major versions. Most PHP sites are very rarely updated. Wordpress does a LOT wrong, but constantly nagging admins to update, and making it easy to do so, is a good thing. The PHP core team values the ability to push out security updates that server admins can be confident won't break anything... Which means that, if you want to deprecate something, the path is: At the next major version change, you do something like emitting a warning or making an argument required. Hopefully over the 3 to 5 years that the major version is alive for, people will address the warning/fix their code. Then, when the next newer major version comes out, you can emit your fatal errors and remove the deprecated feature... But the PHP team will still maintain the old version for bux fixes for 2 years and security issues for 3 years. So the average length of time to truly deprecate things like register_globals is around 8 years. And you'll still have sites breaking because they weren't bothered to look at a single log in all that time.

Open ##2960166