Re: Plug-ins Support

Another approach would be to explicity control all the superglobals via 
the app and force plug-ins to use pre-cleaned, application level globals 
for input, etc.

To force this you could introduce an array called $a_cleaned and grab all 
$_POST && $_GET input, clean it, escape it, and push it into the 
$a_cleaned array then blow away the values in $_POST && $_GET so that they 
cannot be accessed by plug-ins. Same principle can be applied to output 
with a little thought.

On Sun, 14 Oct 2007, leigh m wrote:
> or re-write the whole project in a framework that is already  
> extensible for this like drupal

                *~*
---------------(O.o)--
. Van Tate Jr.
. Software Security && Production Release Manager
. van AT [AT=@] payquik.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/