NYCPHP Meetup

[Chris Shiflett]

Adam Maccabee Trachtenberg wrote:
> I also wanted to point out that these issues are somewhat subtle, and
> it's easy to "know" something is secure, when it's really not at all.

I agree completely. A good example is this blog entry:

http://www-106.ibm.com/developerworks/blogs/dw_blog_comments.jspa?blog=481&entry=75480

Here, Zeev points out that $_SERVER['SERVER_NAME'] can be manipulated by 
the Host header under certain circumstances. Rasmus disputes Zeev's 
claim, asserting that $_SERVER['SERVER_NAME'] is not tainted.

In this case, I believe Zeev is the one who is correct, but the point is 
that we have two of the top authorities on PHP, and one of them is 
incorrectly identifying the origin of a particular variable.

If these guys have trouble with this stuff, what hope is there for the 
rest of us? :-)

Chris

-- 
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/