Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114860
To: Dan Ackroyd <Danack@basereality.com>, Joe Watkins <krakjoe@gmail.com>
Cc: Craig Francis <craig@craigfrancis.co.uk>,
 PHP internals <internals@lists.php.net>,
 Matthew Brown <matthewmatthew@gmail.com>
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAOwTYAt3rztsZ1BTjEbsonqPR_thgG7UqEUO2pKeN=dEg1jqgg@mail.gmail.com>
 <CA+kxMuSJvk2bDM1dQnZHxgiO+YrYhbjS8BziAy+YGSSW8cR1nw@mail.gmail.com>
Message-ID: <f7288bfd-e9e6-f77e-358b-c0d6fe12a9d9@nunninger.info>
Date: Mon, 14 Jun 2021 15:27:47 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <CA+kxMuSJvk2bDM1dQnZHxgiO+YrYhbjS8BziAy+YGSSW8cR1nw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] is_literal
From: thomas@nunninger.info (Thomas Nunninger)

Hi!

> class UserPreferences {
>      private DB $db;
> 
>      function getColor(): string {
>          $preferredColor = $this->db->getColor();
> 
>          if ($preferredColor === 'light') {
>              return '#fff';
>          }
> 
>          if ($preferredColor === 'dark') {
>              return '#000';
>          }
>          return $preferredColor; // user has set custom color.
>      }
> }
> 
> Assume that both UserPreferences and getInfoPanel code is covered by
> unit tests. The developer who made that change would run the tests,
> see the tests pass and then push their code live. At which point, it
> would cause an error in production, as the string returned would not
> pass the is_literal check.
> 
> This would be a complete pain in the butt to fix.

When you write about testing in this database scenario, I find some 
additional issue: When you try to create pure unit tests you would 
somehow mock/stubb or replace the database with some test double. In 
that situation your tests will still pass even if testing the variant 
that the value comes from the database. Only some (infrastructure or 
end-to-end) test that covers the business logic plus the corresponding 
infrastructure by accident would uncover an error.

I wonder if we would need some method to mark a value/variable as 
non-literal. Or perhaps mark some return value (or input parameters?) in 
an interface/class as non-literal using some annotation?

That still puts the burden on the developer to think about that issue. 
But it's probably better than nothing.

Perhaps someone has a better idea?

Cheers
Thomas