Should I allow ‘allow_url_fopen’ in PHP?

by

I think the answer comes down to how well you trust your developers to use the feature responsibly? Data from a external URL should be treated like any other untrusted input and as long as that is understood, what’s the big deal?

The way I see it is that if you treat your developers like children and never let them handle sharp things, then you’ll have developers who never learn the responsibility of writing secure code.

More Related Contents:

  1. Warning about `$HTTP_RAW_POST_DATA` being deprecated
  2. create ini file, write values in PHP
  3. PHP Warning: Module already loaded in Unknown on line 0
  4. Parse HTML as PHP
  5. Stop script execution upon notice/warning
  6. PHP files are downloaded by browser instead of processed by local dev server (MAMP)
  7. How do I include a php.ini file in another php.ini file?
  8. How to always use ignore-platform-reqs flag when running composer?
  9. Pass PHP variable value into HTML label [closed]
  10. Auto Increment ID’s of 4 digit
  11. php nested while loop. Inner loop works only once [closed]
  12. imagepng() expects parameter 1 to be resource [closed]
  13. How to write this array in loop?
  14. Can I bind an array to an IN() condition in a PDO query?
  15. Setting Curl’s Timeout in PHP
  16. Cannot modify header information – headers already sent by… WordPress Issue [duplicate]
  17. PHP Accessing Parent Class Variable
  18. How to read only 5 last line of the text file in PHP?
  19. Remove empty tags from a XML with PHP
  20. How can I send cookies using PHP curl in addition to CURLOPT_COOKIEFILE?
  21. Is mysql_insert_id safe to use?
  22. php validate integer
  23. How to implement Content-Disposition: attachment?
  24. dompdf character encoding UTF-8
  25. PHP – Get key name of array value
  26. How to prefix a positive number with plus sign in PHP
  27. Guzzle 6: no more json() method for responses
  28. PHP Multiple Curl Requests
  29. Interpreting return value of function directly as an array
  30. How to implement a bitmask in php?

Leave a Comment