Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107742
To: Reinis Rozitis <r@roze.lv>, 'PHP Internals' <internals@lists.php.net>
Thread-Topic: [PHP-DEV] [RFC] Deprecate Backtick Operator (V2)
Thread-Index: AQHVfObHTKAn3OaiRE2fNwypPg53F6dQBJrCgABraYCAAAZBAIAAH6gAgABFg+s=
Date: Thu, 31 Oct 2019 14:59:46 +0000
Message-ID:
 <SN6PR06MB3855F9A8CFF8CF060796C4F8DE9A0@SN6PR06MB3855.namprd06.prod.outlook.com>
References: <5d976928.1c69fb81.db3a8.78daSMTPIN_ADDED_MISSING@mx.google.com>
 <CAF+90c9uXdqJsTizLCca-AswenZDv9-6yw=ranATp3XoutHyxw@mail.gmail.com>
 <DM5PR06MB285747B847DE2D7320758C05DE9A0@DM5PR06MB2857.namprd06.prod.outlook.com>
 <e69fb3de-df5f-f77e-ad4e-61ea30185c5c@lsces.uk>
 <CAG9XoMR9DhKDwS1moH_9pjDNyZQ70ER5_stNs_GxQFucZ+ar7A@mail.gmail.com>,<000601d57dc7$ddb9e890$992db9b0$@roze.lv>
In-Reply-To: <000601d57dc7$ddb9e890$992db9b0$@roze.lv>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [4zEsgy9FgJN8pR13EKpFcgoPNkn8pfPO]
x-ms-publictraffictype: Email
x-incomingheadercount: 44
x-eopattributedmessage: 0
x-ms-traffictypediagnostic: BN3NAM04HT050:
x-ms-exchange-purlcount: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 RQDtr8KW19pvp/R9STmK50i41bORqdpipRi54G6LGxO+3yWNnbwweSP8uigySTIJBGDV04N+m8zNxx4td5k8XD9bNM8cTXKivIFmnsrK+6pwwHwM3UJWlUeYDy7V6Vb5gXFggT3T+RJSo5BChDwKEBnWQ2Km2+f7pKwyptfurgfXwjZ4CcYaXuenIr8J1qDn4W80gpYKtywXh03emb60kpLFaNT+swOAAUah+iOk7So=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 1900fb06-70de-4e41-1d5e-08d75e12f852
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Oct 2019 14:59:46.3418
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3NAM04HT050
X-Envelope-From: <theodorejb@outlook.com>
Subject: Re: [PHP-DEV] [RFC] Deprecate Backtick Operator (V2)
From: theodorejb@outlook.com (Theodore Brown)

On Tue, Oct 8, 2019 at 6:02 AM Reinis Rozitis <r@roze.lv> wrote:=0A=
=0A=
> Not directly related to this RFC but out of curiosity - where does=0A=
> this "doing the same thing in multiple ways is confusing" comes from?=0A=
> (I mean this as serious question)=0A=
>=0A=
> I had the impression that programming in essence is all about that -=0A=
> achieving/accomplishing something/the same different ways?=0A=
=0A=
Of course there will always be an infinite number of logical ways to=0A=
structure a program, but this is quite different from having two=0A=
different syntaxes in a language that do exactly the same thing. The=0A=
latter is confusing since it's no longer clear which syntax should be=0A=
used. The same situation existed with the curly brace array/string=0A=
access syntax, which was deprecated in PHP 7.4.=0A=
=0A=
To share my own experience, when I first started needing to run shell=0A=
commands in PHP and came across the backtick operator, I struggled to=0A=
understand the difference between it and `shell_exec`, and which=0A=
should be used in different circumstances. E.g. does the backtick=0A=
operator automatically escape variables? Is it faster than=0A=
`shell_exec`? It also caused me to assume that `shell_exec` must be=0A=
preferred for some reason over `exec` and `proc_open` since there is=0A=
a dedicated syntax for it.=0A=
=0A=
Ultimately it made the whole process of learning how to correctly run=0A=
commands from PHP a lot more confusing than it should have been.=0A=
=0A=
I know I'm not the only one that has been confused by it. If you look=0A=
at the PHP manual page for Execution Operators [1], the top voted=0A=
comment (by far) is from someone who accidentally typed a backtick=0A=
into their code and had a very difficult time debugging why their=0A=
script didn't work as expected.=0A=
=0A=
As I see it, this syntax is not only confusing, but also dangerous.=0A=
A programmer coming from JavaScript might think the backticks are=0A=
simply storing a string, when in fact it will be executed as a command.=0A=
Furthermore, the (undocumented) ability to include variables in the=0A=
command can encourage terse but insecure scripts which fail to=0A=
properly escape user-supplied arguments.=0A=
=0A=
Theodore=0A=
=0A=
[1]: https://www.php.net/manual/en/language.operators.execution.php=