Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109219
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
In-Reply-To: <3F33C0E3-8AE9-4E13-80F1-05E804942488@craigfrancis.co.uk>
Date: Sun, 22 Mar 2020 20:08:37 -0400
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <2872489E-2D70-45E0-AE1C-2CCC272BC45D@newclarity.net>
References: <3F33C0E3-8AE9-4E13-80F1-05E804942488@craigfrancis.co.uk>
To: Craig Francis <craig@craigfrancis.co.uk>
Subject: Re: [PHP-DEV] is_literal() + WordPress
From: mike@newclarity.net (Mike Schinkel)

> On Mar 22, 2020, at 7:14 PM, Craig Francis <craig@craigfrancis.co.uk> =
wrote:
>=20
> On Sun, 22 Mar 2020 at 19:11, Mike Schinkel <mike@newclarity.net> =
wrote:
>> IMO getting that in WordPress core is highly unlikely
>=20
> Good point, like all systems, WordPress will need to consider older =
versions of PHP.
>=20
> But, because this is a new function, they can avoid that issue by =
using `function_exists()`, as in...
>=20
>    if (function_exists('is_literal') && !is_literal($sql)) {
>        trigger_error('This is an unsafe $query, please use =
$wpdb->prepare()', E_USER_NOTICE);
>    }

True....

> This would be a pretty easy way for WordPress to show they take =
security seriously, and helping developers to avoid these "all too =
common" mistakes.
>=20
> But I do appreciate how much effort it can be to introduce anything in =
to WordPress :-)

...but I will let you be the one to champion that cause given how much =
effort not being a core developer and getting anything added to =
WordPress it is.  :-)

-Mike