Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114987
MIME-Version: 1.0
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAFv4g+GYwH-nQ8bLGbm=ThARghGUG5hMpw7W5SjMnSPMTom7+g@mail.gmail.com>
 <CAFv4g+GA9y62phk1TB8Z9EakpAXwmOa5pGxT1pdBVZwkCNxsVA@mail.gmail.com>
 <f9c70ab3-3218-6fc0-06b3-4041f3f78cd4@processus.org> <CAC5V6gi_U-ZHHbYj_MvOw_ifp5hCwnQt6+A3pmS==UDAKO74Yw@mail.gmail.com>
 <CAFv4g+FPGtqZ9cu2qK0HGYH-mOrQvVbnx9L=kLRO9iAXTztDjg@mail.gmail.com> <DF4B726F-8365-44C2-852F-41DC8EF15FA9@newclarity.net>
In-Reply-To: <DF4B726F-8365-44C2-852F-41DC8EF15FA9@newclarity.net>
Date: Mon, 21 Jun 2021 21:24:47 +0100
Message-ID: <CAFv4g+EsFdP+sGVmTiiH8nzoSv0Jy2MV4zF=NfiVOV7Q1g3qtQ@mail.gmail.com>
To: Mike Schinkel <mike@newclarity.net>
Cc: php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000009a438405c54c77c3"
Subject: Re: [PHP-DEV] [RFC] is_literal
From: craig@craigfrancis.co.uk (Craig Francis)

--0000000000009a438405c54c77c3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 18 Jun 2021 at 1:30 pm, Mike Schinkel <mike@newclarity.net> wrote:

> For the avoidance of doubt can you confirm that this $sql would indeed be
> trusted?
>
> $ids =3D array_map( 'intval', $_GET['ids'] ?? [] );
>
> $where =3D implode( ',', $ids );
> $sql =3D 'SELECT * FROM foo WHERE id IN (' . $where . ')';
>
>
> Also, as it is painful to have to use string concatenation, can we please
> consider supporting only the '%s' and '%d' format specifiers when used wi=
th
> trusted strings and integers for sprintf(), respectfully:
>
> $sql =3D sprintf( 'SELECT * FROM foo WHERE id IN (%s)', $where );
>
>
> And
>
> $sql =3D sprintf( 'SELECT * FROM foo LIMIT %d', (int)$limit );
>
>

On Fri, 18 Jun 2021 at 1:32 pm, Mike Schinkel <mike@newclarity.net> wrote:

> Sorry, that should have been:
>
$ids =3D array_map( 'intval', $_GET['ids'] ?? [0] );
>



Yes, I can confirm that that $sql would be trusted.

Yes, sprintf() does support =E2=80=98%s=E2=80=99 and =E2=80=98%d=E2=80=99; =
the function has been updated so
it will return a trusted string if all the inputs are trusted (including
other specifiers).

Both your examples work, as we support integers now (so developers do not
need to change their existing code that use these valid approaches), and if
you want to try it I=E2=80=99ve put your examples on 3v4l.org so you can se=
e it
working here:

https://3v4l.org/FvtpW/rfc#focus=3Drfc.literals

While using parameterised queries is preferred for integers too, it is a
common pattern, and doesn't introduce any Injection Vulnerabilities.

Craig

--0000000000009a438405c54c77c3--