The problem here is that both approaches fail to be completely secure even when your test environment
I don't think taint mode can be truly considered as security feature. It's rather a feature that would remind the developer he needs to think about security. Just as an alarm clock can wake you up, but can't ensure you actually will go to work and do something productive there, tainting can tell you that you need to take care of the variable, but can't ensure the care was right. While I agree with you on the analysis of the escaping security, I do not think that this necessarily makes the whole idea of tainting worthless.
has 100% code coverage. And I am speaking of real 100% ... Currently there is no tool that can ensure that. All PHP CC tools I know of so far will for example not handle the ternary operator correctly.
Most CC tools I know work on line-level, which makes quite hard for them to report on same-line branches, such as ternary operator. Of course they could report on opcode-level, but that'd be hard to read for the user :) So I believe most tools actually know about ternary operators, but can't report about them.
-- Stanislav Malyshev, Zend Software Architect [EMAIL PROTECTED] http://www.zend.com/ (408)253-8829 MSN: [EMAIL PROTECTED] -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
