Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114948
To: Guilliam Xavier <guilliam.xavier@gmail.com>
Cc: internals@lists.php.net
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAFv4g+GYwH-nQ8bLGbm=ThARghGUG5hMpw7W5SjMnSPMTom7+g@mail.gmail.com>
 <CAFv4g+GA9y62phk1TB8Z9EakpAXwmOa5pGxT1pdBVZwkCNxsVA@mail.gmail.com>
 <f9c70ab3-3218-6fc0-06b3-4041f3f78cd4@processus.org>
 <CAC5V6gi_U-ZHHbYj_MvOw_ifp5hCwnQt6+A3pmS==UDAKO74Yw@mail.gmail.com>
Message-ID: <d221707f-7382-479e-6752-d9661f79a303@processus.org>
Date: Fri, 18 Jun 2021 13:25:07 +0200
MIME-Version: 1.0
In-Reply-To: <CAC5V6gi_U-ZHHbYj_MvOw_ifp5hCwnQt6+A3pmS==UDAKO74Yw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Subject: Re: [PHP-DEV] Re: [RFC] is_literal
From: pierre-php@processus.org (Pierre)

Le 18/06/2021 à 12:45, Guilliam Xavier a écrit :
> IIUC, with the addition of integers, the function will return true for e.g.
> `'SELECT * FROM foo LIMIT ' . (int)$limit` even if $limit doesn't come from
> a "static" value (e.g. random_int() or even `$_GET['limit']`)

OK I get it.

I followed the initial discussions but I didn't read everything for a while.

Doesn't it mean that is_literal() which doesn't test anymore if 
something is literal does a bit more than that ?

The original intent of being able to tell if a string is literal or not 
seems to be a very good idea, but now it forked to something that is 
more SQL-OtherDatabase business related: this means that PHP own std 
will, in my opinion, take a role it isn't supposed to have, by 
arbitrarily (don't take wrongly, all discussions I had read until now 
are smart and make sense) telling people what is safe, and what is not ?

The original is_literal() function idea is nice, why not having both, 
is_literal() that exposes a purely technical information in one side, 
and is_secure() that is more specialized and supposes what is safe or 
not considering more than simply string static state, for std provided 
SQL database layers ?

In such scenario, userland libraries could use, depending on their own 
need, one or both of theses functions.

I'd much like to have the is_literal() function for my own needs, I do 
maintain an SQL query builder, but I don't expect it to handle int and 
other types as well, I'll probably continue to handle those by myself 
since I have a custom escaping API. In my use case, I'd probably not use 
the is_secure() function but I would use the is_literal() one, mostly 
for performance reasons (avoid to escape something that doesn't need to be).

I think that both being introduced at the same time is a good idea.

Regards,

--

pierre