Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115005
MIME-Version: 1.0
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <CAOwTYAt3rztsZ1BTjEbsonqPR_thgG7UqEUO2pKeN=dEg1jqgg@mail.gmail.com>
 <CA+kxMuSJvk2bDM1dQnZHxgiO+YrYhbjS8BziAy+YGSSW8cR1nw@mail.gmail.com> <f7288bfd-e9e6-f77e-358b-c0d6fe12a9d9@nunninger.info>
In-Reply-To: <f7288bfd-e9e6-f77e-358b-c0d6fe12a9d9@nunninger.info>
Date: Tue, 22 Jun 2021 09:53:35 +0100
Message-ID: <CA+kxMuQ5AkOmgoidX2Mt+y31B=6SwLctCcr6S+s5jf7boH=omA@mail.gmail.com>
To: Thomas Nunninger <thomas@nunninger.info>
Cc: Joe Watkins <krakjoe@gmail.com>, Craig Francis <craig@craigfrancis.co.uk>, 
	PHP internals <internals@lists.php.net>, Matthew Brown <matthewmatthew@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] [RFC] is_literal
From: Danack@basereality.com (Dan Ackroyd)

On Mon, 14 Jun 2021 at 14:27, Thomas Nunninger <thomas@nunninger.info> wrote:
>

Thomas Nunninger wrote:

Thomas Nunninger wrote:
> Only some (infrastructure or
> end-to-end) test that covers the business logic plus the corresponding
> infrastructure by accident would uncover an error.


I think testing will be much less of an issue than you might expect,
but partly only if string concatenation doesn't carry the flag around.

The whole point of the idea of literal strings is to make it be easier
to write some code that:

i) is safe.
ii) can be reasoned about at scale.

Passing bare strings around is not so great for either of those
things. You have to manually remember "this is a string that is
intended to be used in a particular way. And doing that in a large
code base, when your engineering department is large enough to work in
separate teams is particularly difficult.

Instead of using bare strings, using a more specific type e.g.
HtmlAttribute::fromString('#fff'); and then passing that around would
be much easier to reason about.

Similarly for the thoughts about concatenating numbers into strings.
Yeah, people might think they want that, but in practice using an SQL
builder that allows you to put the number in the right place like:

$sqlBuilder->add('SELECT * FROM foo LIMIT %d', FIXED_LIMIT);


And then predictable when the request comes in to allow users to set
their own limit, changing it to:

$sqlBuilder->add('SELECT * FROM foo LIMIT %d', $_GET['limit']);

Doesn't take any time to refactor the code, because it's already using
an appropriate library that handles variables correctly.

cheers
Dan
Ack