Re: [PHP] Saving of buffers, from a security standpoint

2005-05-12 Thread Colin Ross
in my own defence, i too am not much of a silent failure kinda guy. Custom errar handlers are great, (i user PEAR::ErrorStack and it works great) my point is that in a public, production environment, i'd rather have anything not caught by the custom eror handler go unseen by the browser, althou

Re: [PHP] Saving of buffers, from a security standpoint

2005-05-11 Thread Richard Lynch
Personally, I'd rather have the error messages go SOMEWHERE useful, and write custom error handler to put "nice" error messages to the browser that reveal nothing. If things go wrong in my script/software/hardware/network, I don't want the system to just silently FAIL and swallow errors. Yes, it'

Re: [PHP] Saving of buffers, from a security standpoint

2005-05-11 Thread Colin Ross
at this point, I'm planning on (at least on production) turning off all error reporting, I am using PEAR::ErrorStack mainly for error handling, which I love using btw... all I'm trying to do is make sure that no information gets outputed from the script, even if some horrible error occurs, i gu

Re: [PHP] Saving of buffers, from a security standpoint

2005-05-11 Thread Richard Lynch
On Wed, May 11, 2005 10:02 am, Colin Ross said: > I am working on a bit of code for credit-card processing, so please keep > in > mind, security of the data is essential.. > On part of it i wish to use a buffer, but i wonder if that data is saved > anywhere on the running system (as a temp file, et

Re: [PHP] Saving of buffers, from a security standpoint

2005-05-11 Thread Brent Baisley
You can't be assured that the data is stored only in RAM. Just about all systems use some sort of swap space, so what is stored in memory could end up on disk in a swap file. Of course, if someone is able to access the swap files on your computer, you're probably dead already. PHP also stores s

[PHP] Saving of buffers, from a security standpoint

2005-05-11 Thread Colin Ross
I am working on a bit of code for credit-card processing, so please keep in mind, security of the data is essential.. On part of it i wish to use a buffer, but i wonder if that data is saved anywhere on the running system (as a temp file, etc), or is it just held in the system's memory? My conce