Re: [tlug] Clamav reports a virus: Exploit.Gif.PHPembedded

[Brian Chandler <brian@example.com>]

Stephen J. Turnbull wrote:
> Hung Nguyen Vu writes:
>
>  > I still don't understand whyPHP doesn't check the input more carefully.
>
> Because the generic case is hard to do, and PHP is not about doing
> hard things, it's about making tedious things convenient.  It leaves
> the hard things up to the programmer, who usually knows enough about
> the input that he can do a few simple checks and be reasonably safe.

But I don't really see what criticism there could be here of PHP as 
such. PHP provides a function to include a file and run it through the 
php interpreter - what more or less could it do? The problem is surely 
one of sloppy programming. AAMOF, I think that most of the publicised 
problems hereabouts come from generic applications abusing very general 
mechanisms.

I don't understand quite what input the OP thinks PHP should check, either.

Brian Chandler
http://imaginatorium.org