News for hackers. Stuff that matters.
Re:The Magic 0xC2 by mschuster91 on Tuesday April 11, 2017 @01:41PM (#14090496)
> PHP also has nice footguns in that area.

PHP would deal with uploaded files by itself and write them correctly and directly to disk (unlike some Java implementations like Nexus which buffers in RAM, you can guess what happens).

As for ordinary POST/GET parameters, it stores them in a string aka a byte stream which you can then post-process e.g. by translating to UTF-8 based on the browser encoding header. So basically the only way to shoot yourself is if you're doing substr and friends on user input instead of using the mb_ variants.

Re:The Magic 0xC2 by wahern on Tuesday April 11, 2017 @01:46PM (#14090552)

  unlike some Java implementations like Nexus which buffers in
  RAM, you can guess what happens
I can't guess. It's 2017 and everybody knows that RAM is unlimited and nobody need ever worry about an OOM condition. Assuming, for the sake of argument, that RAM isn't unlimited, it's unrecoverable, anyhow--modern language designers and Linux kernel architects have made sure of it.