Serendipity Forums

s9y uses many uninitialized variables especially in the backend, so that many notices such as

Notice: Undefined index: no_create in /var/www/virtual/xxx/include/functions_config.inc.php on line 1218

Notice: Undefined index: head_title in /var/www/virtual/xxx/include/functions_smarty.inc.php on line 964

Notice: Undefined index: head_subtitle in /var/www/virtual/xxx/include/functions_smarty.inc.php on line 965

Notice: Undefined variable: template_loaded_config in /var/www/virtual/xxx/include/functions_smarty.inc.php on line 1004

Notice: Undefined index: plugintab in /var/www/virtual/xxx/plugins/serendipity_plugin_twitter/serendipity_event_twitter.php on line 125

or

Notice: Undefined index: description in /var/www/virtual/xxx/include/functions_plugins_admin.inc.php on line 43

are thrown when error_reporting is set to E_ALL.
Not only is this this flawed programming, it is also a potential security risk (not only when register_globals is activated).

You should reduce these notices. Properly written PHP applications shouldn't even throw E_STRICT notices.

Hi!

Yes....uninitialized variables are actually a huge benefit in scripting languages, which is why s9y makes use of it. Adding checks for uninintialized vars or initializing them often adds more lines of code, and (even if littile) some parsing time.

I don't really think that this is something worth changing, as long as no security issues can arise from it (which should be ensured in the cases were it happens).

If someone wants to dedicate time for this to prepare a patch though, I would of course commit it - but I would not dedicate my personal time to this as I don't find it necessary and do not actually think it is bad programming style, rather making use of what PHP is: A scripting, untyped language. That the PHP team raises a E_STRICT error on this is IMHO the larger flaw.

(Yes, I know that everyone has their own oppinion on this, and I can accept other voices on this - but those voices would need to provide a patch *g*)

Best regards,
Garvin

Well, let's see if I find the time for this one day. I still don't consider it good programming, but I also don't want to start flaming. Making use of weak typing is okay in my opinion, but not initializing variables often results in errors which take very long to investigate or even in security holes.