Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109187
MIME-Version: 1.0
References: <CAFv4g+EXxWsD5jvfbYVKwML7fMCp62vFPfP0VfOmNBLR-tUpHQ@mail.gmail.com>
 <0138464a-b583-4a0a-9e05-d3afc1d62017@www.fastmail.com>
In-Reply-To: <0138464a-b583-4a0a-9e05-d3afc1d62017@www.fastmail.com>
Date: Sat, 21 Mar 2020 20:09:34 +0000
Message-ID: <CAFv4g+FbjHZyYPGtobWitOg_Z3fAvDyNA71uk72G5X8dHToDnQ@mail.gmail.com>
To: Larry Garfield <larry@garfieldtech.com>
Cc: php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000ad23cd05a162fb5e"
Subject: Re: [PHP-DEV] [RFC] is_literal()
From: craig@craigfrancis.co.uk (Craig Francis)

--000000000000ad23cd05a162fb5e
Content-Type: text/plain; charset="UTF-8"

On Sat, 21 Mar 2020 at 19:51, Larry Garfield <larry@garfieldtech.com> wrote:

> Eg, there's plenty of very good reasons to put a template string into the
> database rather than a file literal.  Or to build an SQL query dynamically
> in ways that an is_literal check would not allow, at least not without an
> absurdly complex query builder.



Thanks Larry,

I think the examples I've provided should cover the issues that typically
get raised.

The main ones tend to be "WHERE x IN (?,?,?)" and "ORDER BY variable",
where the current work arounds get a bit risky (such as string escaping),
but please let me know if I've missed any.

Craig




On Sat, 21 Mar 2020 at 19:51, Larry Garfield <larry@garfieldtech.com> wrote:

> On Sat, Mar 21, 2020, at 2:13 PM, Craig Francis wrote:
> > Hi,
> >
> > I've written up my suggestion for a is_literal() function:
> >
> > https://wiki.php.net/rfc/is_literal
> >
> > Any feedback would be appreciated.
> >
> > Craig
>
> While I appreciate the intent, without an untaint() or equivalent I fear
> its usefulness will be limited, or else it will get overused and thus cut
> off numerous entirely valid situations.
>
> Eg, there's plenty of very good reasons to put a template string into the
> database rather than a file literal.  Or to build an SQL query dynamically
> in ways that an is_literal check would not allow, at least not without an
> absurdly complex query builder.
>
> Without a way to flag "yes, I know this was built dynamically but I've
> vetted it, it's OK" on a value, I fear such a check will either be unuseful
> or counter-productive.
>
> --Larry Garfield
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--000000000000ad23cd05a162fb5e--