Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115101
MIME-Version: 1.0
References: <CAFv4g+Gv1qQ2Gtx2Qwo0Dx2Cb_gOXJ=rm7rVy+Jo89PmD-3jnA@mail.gmail.com>
 <CAEMvS4GRaqMBPn7ocBX-XU3jzrtpe+9uGfYpG10qc_iKZY80UA@mail.gmail.com>
 <03f7955c-69a8-4841-9245-449d7851e207@www.fastmail.com> <CAFv4g+EaT309KDWz63j3S7n8E58czEWTKUEw9hAvgt7s6R9eKQ@mail.gmail.com>
 <CAKws9z02yCZTb2_mw-5xUO5-QLc4jbOUcBRfJ8nFSNPP1rgO3g@mail.gmail.com>
 <CA+hqhpfUiOMLDZyXTqP+mm9jjG6v+K94Ug7K_zvuuZus_XhOaQ@mail.gmail.com>
 <CAKws9z34nTT0_CXoo4Yq7zO2CZX622has23xmfHbWjfaDrgLqA@mail.gmail.com>
 <CA+hqhpdR=W8nbWy8UBgLtKdvb_KCss5mpzturS67HhqRj4q6BQ@mail.gmail.com>
 <CAKws9z1=6fmCxJWYVfN+xKT+u=_ZTq0m7C0nZPT6LB5scbfpXQ@mail.gmail.com>
 <95D16F2E-E9DD-4964-A0E2-62E1FB0D976B@koalephant.com> <CAKws9z0CbyjeKas=DNKi0ScdUxt8CnvNOLymXpWvQTaJtB0xkw@mail.gmail.com>
 <CAC5V6gjV6sis6sVN8g2AZGb7VQf5ncVT9DCZfp1xi=+moj4aew@mail.gmail.com>
In-Reply-To: <CAC5V6gjV6sis6sVN8g2AZGb7VQf5ncVT9DCZfp1xi=+moj4aew@mail.gmail.com>
Date: Thu, 24 Jun 2021 05:19:17 -0400
Message-ID: <CAKws9z08xyGcXv380EstiNy0fZZijQ0TZ=mZUvW=_ii4yXLsrw@mail.gmail.com>
To: Guilliam Xavier <guilliam.xavier@gmail.com>
Cc: php internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted
From: scott@paragonie.com (Scott Arciszewski)

On Thu, Jun 24, 2021 at 4:34 AM Guilliam Xavier
<guilliam.xavier@gmail.com> wrote:
>
>
> On Thu, Jun 24, 2021 at 9:14 AM Scott Arciszewski <scott@paragonie.com> w=
rote:
>>
>> On Thu, Jun 24, 2021 at 2:10 AM Stephen Reay <php-lists@koalephant.com> =
wrote:
>>
>> > I would absolutely make use of a function that tells me if the string =
given is in fact from something controlled by the developer. But once that =
same string can also include input from the request or the environment or w=
hatever by nature of integers, the function becomes useless for the stated =
purpose.
>>
>> Why not two functions then?
>>
>> - is_noble_string() -- more restrictive
>> - is_noble() -- YOLO
>
>
> I was going to ask basically the same [with different names] a few days a=
go ("why can't we have both?"), but then remembered https://externals.io/me=
ssage/114835#114951 , esp. the end:
>
> """
> And to support having 2 functions, we would need 2 flags on strings. Thes=
e
> flags are limited, and managing 2 flags would affect performance.
> """
>
> Regards,
>
> --
> Guilliam Xavier

Thanks for the reference to that part of the discussion that I missed.

Aside:

I encourage everyone to look at EasyDB (especially EasyStatement) for
handling `WHERE x IN (a, b, c, ...)` statements in SQL.
https://github.com/paragonie/easydb

Additionally, Ionizer is useful for input filtering and asserting type
safety: https://github.com/paragonie/ionizer

If you're doing dynamic, on-the-fly SQL query generation (based, in
part, on user input), these are two framework-agnostic tools that can
help make your code safer against code injection and other attacks.