Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:106125
MIME-Version: 1.0
References: <e0af1d39-9468-f845-6784-4308a4c8a201@beccati.com>
In-Reply-To: <e0af1d39-9468-f845-6784-4308a4c8a201@beccati.com>
Date: Tue, 2 Jul 2019 15:07:30 +0200
Message-ID: <CAF+90c_nK=R=FDgX_xS388xsZJQ1UfANC61Fb7joyeCY9i-+rQ@mail.gmail.com>
To: Matteo Beccati <php@beccati.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000517fce058cb26ef7"
Subject: Re: [PHP-DEV] [RFC] Escape PDO "?" parameter placeholder
From: nikita.ppv@gmail.com (Nikita Popov)

--000000000000517fce058cb26ef7
Content-Type: text/plain; charset="UTF-8"

On Fri, May 31, 2019 at 1:27 PM Matteo Beccati <php@beccati.com> wrote:

> Hi everyone,
>
> following some recent unrest in the comments of the related PR, I've
> decided to invest a bit of time on it and finally move it to draft status:
>
> https://wiki.php.net/rfc/pdo_escape_placeholders
>
> The PR is currently closed, but I will soon rebase and update it.
>
> Any feedback kindly accepted!
>

Friendly reminder that this RFC needs to go into voting until Monday
(preferably earlier) to make it into 7.4.

Here's my feedback:

 * I would prefer to make escaping not driver-sensitive, as the current
implementation is. Whether ?? is interpreted as a single ? or ?? should not
depend on the driver.
 * I would prefer to use \? instead of ?? for escaping. The former is much
more easily understood by a PHP developer and has less chance of clashing
with operators (PHP itself has a ?? operator, it's not so absurd to think
that it also exists elsewhere). The RFC argues against this because it
makes writing a literal \? harder (which would be \\\\?), but I think that
a) the need for a literal \? seems rather rare and b) double-escaping is
already a well-understood problem for anyone who ever used regular
expressions.

Regards,
Nikita

--000000000000517fce058cb26ef7--