防止模板静态访问业务类

Question

I have a framework (of sorts) that has Presentation logic & Business logic.

My problem is that the Business logic calls methods statically, therefore, no instance of the class is needed. One of these classes is called Config that holds (some) dangerous info (like DB connection info). So how do I stop the presentation logic from doing this:

var_dump(Config::get('database'));

Answer 1

If your templates have the ability to execute arbitraty PHP code you cannot.

Unless you have a template engine where templates are fully "sandboxed" you cannot allow untrusted users to edit templates.

However, for database connection information, you could simply unset those variables after they've been used. Doesn't stop someone from writing PHP code in his template which reads the config file again though ...