Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105813
MIME-Version: 1.0
References: <e0af1d39-9468-f845-6784-4308a4c8a201@beccati.com>
In-Reply-To: <e0af1d39-9468-f845-6784-4308a4c8a201@beccati.com>
Date: Fri, 31 May 2019 17:18:56 +0100
Message-ID: <CALKiJKp9o3k-Q5pT-E_CMF5JxMR7RuBercn5x8myqR99YE4nUQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000c3dd58058a315ff6"
Subject: Re: [PHP-DEV] [RFC] Escape PDO "?" parameter placeholder
From: rowan.collins@gmail.com (Rowan Collins)

--000000000000c3dd58058a315ff6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 31 May 2019 at 12:27, Matteo Beccati <php@beccati.com> wrote:

> Hi everyone,
>
> following some recent unrest in the comments of the related PR, I've
> decided to invest a bit of time on it and finally move it to draft status=
:
>
> https://wiki.php.net/rfc/pdo_escape_placeholders
>


Hi Matteo,

This sounds like a very useful change. As you say in the RFC, these
operators are going to be more and more common for Postgres users now that
they've been defined for JSON types, and users of most other DBMSes will be
completely unaffected.

I wonder if there's any way we can gauge the BC impact, specifically this
case:

> The only exception to that is that Postgres (and possibly other RDMSs)
allows the creation of custom operators: anyone having a custom =E2=80=9C??=
=E2=80=9D
operator in use would need to escape it as =E2=80=9C????=E2=80=9D.

- Are there any standard or public Postgres extensions that define a "??"
operator? e.g. anything published on https://pgxn.org/
- Are there any other databases supported by PDO that allow custom
operators, or which might have a "??" operator or syntax token?

If there is a risk of this affecting a reasonable number of people, we
could add a deprecation notice on encountering "??" in any SQL string in
7.4, and postpone adding the escaping mechanism until 8.0.


One other thing worth clarifying is the precise circumstances where ?? will
be treated as an escape. Is it only when it's a separate "word" (start/end
of string or surrounded by whitespace)? For instance, would "A ??=3D B" be
"unescaped" to "A ?=3D B" or passed through as is? Note that this changes t=
he
scope of the BC break, as well as the usability of the chosen syntax, as
both "?=3D" and "??=3D" could be defined as operators.


Regards,
--=20
Rowan Collins
[IMSoP]

--000000000000c3dd58058a315ff6--