Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

"The visibility of a property or method can be defined by prefixing the declaration with the keywords: public, protected or private. Public declared items can be accessed everywhere. Protected limits access to inherited and parent classes (and to the class that defines the item). Private limits visibility only to the class that defines the item."

How do you see this as not a bug considering that last statement in the documentation on Visibility in PHP 5 Classes (see http://us2.php.net/manual/en/language.oop5.visibility.php).

This is either a bug or bad documentation.  In all logic and understanding, the visibility of a private property should be hidden from any functions such as print_r, overriding the purpose of print_r.

http://php.net/print_r

"print_r(), var_dump() and var_export() will also show protected and private properties of objects with PHP 5."

Can this behavior be disabled?  A new feature perhaps?

Why don't you simply disable these functions?

Please, this is silly. Private and protected variables should be just that.

There are many ways to get at private methods and properties. One of which is 
simply looking at the source code. PHP is not a compiled language. The visibility 
feature is simply a runtime hint, it is not meant in any way to protect the code, 
and debugging functions such as var_dump and print_r are going to show the full 
objects.

It is possible to prevent the output of sensitive private data by creating an anonymous function, but the object is not serializable anymore.

This should work with PHP 4 >= 4.0.1 and PHP 5 (based on the documentation of the used functions).

code: 
-----
<?php

class Credentials {
    private $_user;
    private $_password;
    
    function __construct($user, $password) {
        $this->_user = $user;
        
        //uses base64 to get sure the string is escaped
        $base64 = base64_encode($password);
        $function = "return base64_decode('" . $base64 .  "');";
        
        $this->_password = create_function("", $function);
    }
    
    public function getUser() {
        return $this->_user;
    }

    public function getPassword() {
        return call_user_func($this->_password);
    }
}

$credentials = new Credentials("theUserName", "thePassKey");

echo "\n\nprint_r:\n";
print_r($credentials);

echo "\n\nvar_dump:\n";
var_dump($credentials);

echo "\n\nvar_export:\n";
var_export($credentials);


output: 
-----


print_r:
Credentials Object
(
    [_user:Credentials:private] => theUserName
    [_password:Credentials:private] => lambda_1
)


var_dump:
object(Credentials)#1 (2) {
  ["_user":"Credentials":private]=>
  string(11) "theUserName"
  ["_password":"Credentials":private]=>
  string(9) "lambda_1"
}


var_export:
Credentials::__set_state(array(
   '_user' => 'theUserName',
   '_password' => '' . "\0" . 'lambda_1',
))