Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114839
MIME-Version: 1.0
Date: Sat, 12 Jun 2021 23:45:55 +0300
To: Craig Francis <craig@craigfrancis.co.uk>
Cc: PHP internals <internals@lists.php.net>
In-Reply-To: <CAFv4g+HfMGwhqH71Gm_mWbwP2=Oq9_QfPa1D+aff22v=FHaazg@mail.gmail.com>
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <315be10c00c5e68238fb210ee543df1d@gmail.com>
 <CAFv4g+HfMGwhqH71Gm_mWbwP2=Oq9_QfPa1D+aff22v=FHaazg@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.11
Message-ID: <0479231c51cebfecedce59b367f3a934@gmail.com>
Content-Type: multipart/alternative;
 boundary="=_51c7679660437ce88b372fa23f45b2fb"
Subject: Re: [PHP-DEV] [RFC] is_literal
From: lauri.kentta@gmail.com (=?UTF-8?Q?Lauri_Kentt=C3=A4?=)

--=_51c7679660437ce88b372fa23f45b2fb
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8;
 format=flowed

On 2021-06-12 22:21, Craig Francis wrote:

> On Sat, 12 Jun 2021 at 19:59, Lauri Kenttä <lauri.kentta@gmail.com> 
> wrote:
> 
>> Hi,
>> 
>> I wrote the untaint() / make_literal() function, just in case.
>> 
>> implode("", array_map(fn($c) => $chars[ord($c)], str_split($s, 1)))
>> 
>> https://3v4l.org/EaN9Z#focus=rfc.literals
>> 
>> Sorry and bye.
> 
> Yes, I have a similar example in the RFC (eval).

Oh, the irresponsible use of eval was so overwhelming that I missed the 
new string literal there. You could add var_export to make it more 
realistic.

Anyway, the RFC is well motivated and thoroughly thought out. The 
approach is very simple but fits many use cases, compared to previous 
alternatives which were complex but more limited in the end. When 
libraries and PDO start to use this, we can finally get rid of SQL 
injections and a number of self-made input handling tricks, if only 
people have learned to read warnings...

So thanks for writing this RFC. I hope it passes.

-- 
Lauri Kenttä
--=_51c7679660437ce88b372fa23f45b2fb--