Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114950
Message-ID: <B7F75525-36C6-469A-8E84-DF1892308F25@newclarity.net>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_F39A6AE6-8246-488F-9F68-ED2D06EC2C52"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
Date: Fri, 18 Jun 2021 08:32:22 -0400
In-Reply-To: <DF4B726F-8365-44C2-852F-41DC8EF15FA9@newclarity.net>
Cc: php internals <internals@lists.php.net>
To: Craig Francis <craig@craigfrancis.co.uk>
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAFv4g+GYwH-nQ8bLGbm=ThARghGUG5hMpw7W5SjMnSPMTom7+g@mail.gmail.com>
 <CAFv4g+GA9y62phk1TB8Z9EakpAXwmOa5pGxT1pdBVZwkCNxsVA@mail.gmail.com>
 <f9c70ab3-3218-6fc0-06b3-4041f3f78cd4@processus.org>
 <CAC5V6gi_U-ZHHbYj_MvOw_ifp5hCwnQt6+A3pmS==UDAKO74Yw@mail.gmail.com>
 <CAFv4g+FPGtqZ9cu2qK0HGYH-mOrQvVbnx9L=kLRO9iAXTztDjg@mail.gmail.com>
 <DF4B726F-8365-44C2-852F-41DC8EF15FA9@newclarity.net>
Subject: Re: [PHP-DEV] [RFC] is_literal
From: mike@newclarity.net (Mike Schinkel)

--Apple-Mail=_F39A6AE6-8246-488F-9F68-ED2D06EC2C52
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



> On Jun 18, 2021, at 8:30 AM, Mike Schinkel <mike@newclarity.net> =
wrote:
>=20
>=20
>> On Jun 18, 2021, at 7:22 AM, Craig Francis <craig@craigfrancis.co.uk =
<mailto:craig@craigfrancis.co.uk>> wrote:
>>=20
>> On Fri, 18 Jun 2021 at 11:45 am, Guilliam Xavier =
<guilliam.xavier@gmail.com <mailto:guilliam.xavier@gmail.com>>
>> wrote:
>>=20
>>> IIUC, with the addition of integers, the function will return true =
for e.g.
>>> `'SELECT * FROM foo LIMIT ' . (int)$limit` even if $limit doesn't =
come from
>>> a "static" value (e.g. random_int() or even `$_GET['limit']`)
>>=20
>> Yes, that=E2=80=99s correct.
>>=20
>> Supporting integers from any source helps with adoption, and we =
cannot find
>> any security issues (it=E2=80=99s a fairly small change to the RFC, =
and that
>> prompted the new name, especially as the original is_literal wasn=E2=80=
=99t
>> perfect).
>=20
> For the avoidance of doubt can you confirm that this $sql would indeed =
be trusted?
>=20
> $ids =3D array_map( 'intval', $_GET['ids'] ?? [] );

Sorry, that should have been:

$ids =3D array_map( 'intval', $_GET['ids'] ?? [0] );


-Mike


--Apple-Mail=_F39A6AE6-8246-488F-9F68-ED2D06EC2C52--