Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109184
User-Agent: Cyrus-JMAP/3.1.7-1021-g152deaf-fmstable-20200319v1
Mime-Version: 1.0
Message-ID: <0138464a-b583-4a0a-9e05-d3afc1d62017@www.fastmail.com>
In-Reply-To: 
 <CAFv4g+EXxWsD5jvfbYVKwML7fMCp62vFPfP0VfOmNBLR-tUpHQ@mail.gmail.com>
References: 
 <CAFv4g+EXxWsD5jvfbYVKwML7fMCp62vFPfP0VfOmNBLR-tUpHQ@mail.gmail.com>
Date: Sat, 21 Mar 2020 14:50:44 -0500
To: "php internals" <internals@lists.php.net>
Content-Type: text/plain
Subject: Re: [PHP-DEV] [RFC] is_literal()
From: larry@garfieldtech.com ("Larry Garfield")

On Sat, Mar 21, 2020, at 2:13 PM, Craig Francis wrote:
> Hi,
> 
> I've written up my suggestion for a is_literal() function:
> 
> https://wiki.php.net/rfc/is_literal
> 
> Any feedback would be appreciated.
> 
> Craig

While I appreciate the intent, without an untaint() or equivalent I fear its usefulness will be limited, or else it will get overused and thus cut off numerous entirely valid situations.

Eg, there's plenty of very good reasons to put a template string into the database rather than a file literal.  Or to build an SQL query dynamically in ways that an is_literal check would not allow, at least not without an absurdly complex query builder.

Without a way to flag "yes, I know this was built dynamically but I've vetted it, it's OK" on a value, I fear such a check will either be unuseful or counter-productive.

--Larry Garfield