Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114564
MIME-Version: 1.0
References: <CAFv4g+EK_5YF+YGdKBYfYX-_730k39Fdq4hAG4gEApebyv5eDg@mail.gmail.com>
 <CAFv4g+Emp3L=w6tMG9ZLMh3a8Bb0V_aSrD9A-TRLwNn1ODNkug@mail.gmail.com> <CAFv4g+E_dfErbkovpu2YxcGrzyKNdOKzee6TfbrfCXgqEs3NCg@mail.gmail.com>
In-Reply-To: <CAFv4g+E_dfErbkovpu2YxcGrzyKNdOKzee6TfbrfCXgqEs3NCg@mail.gmail.com>
Date: Mon, 24 May 2021 15:52:01 +0200
Message-ID: <CAC5V6gj+OSzPDY2nCtXRDh_JvqxOYiZbUwdO0SEnygqwUUmmtQ@mail.gmail.com>
To: Craig Francis <craig@craigfrancis.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000040d05f05c313b77c"
Subject: Re: [PHP-DEV] Re: Injection vulnerabilities
From: guilliam.xavier@gmail.com (Guilliam Xavier)

--00000000000040d05f05c313b77c
Content-Type: text/plain; charset="UTF-8"

On Fri, May 21, 2021 at 11:21 PM Craig Francis <craig@craigfrancis.co.uk>
wrote:

> [...]
>
> We need something that libraries will (in the future) be able to use to
> protect themselves against these mistakes... by all programmers, especially
> those who aren't using static analysis.
>

Hi,

Not sure what kind of answer you expect... Are you suggesting to provide
one or both of:
  1. a way to forbid "dynamic" strings (or at least detect them)?
  2. "safe" HTML, SQL and OS-command builder/generator/executor APIs (that
would internally restrict/validate their "static" parts and quote/escape
the dynamic parameters)?

Regards,

-- 
Guilliam Xavier

--00000000000040d05f05c313b77c--