Hacker News Reader

Variable declaration is pretty core to the language. Remember register_globals? That was only a problem because so much code relied on having undeclared variables act like empty strings.

I suppose they could have made it work differently just for nested functions, but that's a major inconsistency, it's not clear how it would interact with globals, etc.

View on HN

register globals didn't "make undeclared variables act like empty strings".

register globals imported request parameters from the query string and post body into the global variable scope.

having undeclared variables "act like empty strings" is related to non-strict variable comparison (== vs ===) and either silencing errors, or not displaying/caring about them.

register_globals could not have existed without the legality of undeclared variables, and it could not have been a security issue without code that relied on using undefinedness as a default value.

undeclared variabels aren't legal, they cause errors. if your php is configured to ignore those errors thats on you.

of course it could be a security issue without undefined variables coercing to an empty string in string context - it could allow request parameters to override defined variables.

Reply on news.ycombinator.com