Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115107
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\))
In-Reply-To: <CAGBsUrfar+bY+4R9Wp=WfTr5r7-Ur0pVDmNYGJTt1nh9AQ3-Zw@mail.gmail.com>
Date: Thu, 24 Jun 2021 17:33:53 +0700
Cc: Scott Arciszewski <scott@paragonie.com>,
 Bruce Weirdan <weirdan@gmail.com>,
 Craig Francis <craig@craigfrancis.co.uk>,
 Larry Garfield <larry@garfieldtech.com>,
 php internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <26037CB4-4723-4DC5-BD92-BBDC4F548E17@koalephant.com>
References: <CAFv4g+Gv1qQ2Gtx2Qwo0Dx2Cb_gOXJ=rm7rVy+Jo89PmD-3jnA@mail.gmail.com>
 <CAEMvS4GRaqMBPn7ocBX-XU3jzrtpe+9uGfYpG10qc_iKZY80UA@mail.gmail.com>
 <03f7955c-69a8-4841-9245-449d7851e207@www.fastmail.com>
 <CAFv4g+EaT309KDWz63j3S7n8E58czEWTKUEw9hAvgt7s6R9eKQ@mail.gmail.com>
 <CAKws9z02yCZTb2_mw-5xUO5-QLc4jbOUcBRfJ8nFSNPP1rgO3g@mail.gmail.com>
 <CA+hqhpfUiOMLDZyXTqP+mm9jjG6v+K94Ug7K_zvuuZus_XhOaQ@mail.gmail.com>
 <CAKws9z34nTT0_CXoo4Yq7zO2CZX622has23xmfHbWjfaDrgLqA@mail.gmail.com>
 <CA+hqhpdR=W8nbWy8UBgLtKdvb_KCss5mpzturS67HhqRj4q6BQ@mail.gmail.com>
 <CAKws9z1=6fmCxJWYVfN+xKT+u=_ZTq0m7C0nZPT6LB5scbfpXQ@mail.gmail.com>
 <95D16F2E-E9DD-4964-A0E2-62E1FB0D976B@koalephant.com>
 <CAKws9z1M6aLMJ+T7KEAYbEu7N3ufFi8Lsqpr4GP6G06+8aG3SQ@mail.gmail.com>
 <4DE5E2EC-26D6-4D2C-95A9-B843B440EE87@koalephant.com>
 <CAGBsUrfar+bY+4R9Wp=WfTr5r7-Ur0pVDmNYGJTt1nh9AQ3-Zw@mail.gmail.com>
To: Kamil Tekiela <tekiela246@gmail.com>
Subject: Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted
From: php-lists@koalephant.com (Stephen Reay)



> On 24 Jun 2021, at 17:07, Kamil Tekiela <tekiela246@gmail.com> wrote:
>=20
> Hi Stephen,
>=20
> I believe the idea was for dynamically generate table names, or =
numbered tables/columns. E.g.=20
>=20
> function getTable(string $table){
>     // is_literal check here
> }
>=20
> $number =3D (int) $_GET['tableno'];
> if($number < 0 || $number > 10) {
>     throw new Exception("Invalid number");
> }
>=20
> $tablename =3D 'table_'.$number;
> getTable($tablename);
>=20
> The number is concatenated to the table name.=20
>=20
> =E2=80=94Kamil

Hi Kamil,

Thanks for at least trying to answer this question.

I=E2=80=99m sure someone somewhere does that and thinks its a good idea. =
I respectfully (to you; probably less respectfully to someone if they =
tell me they do this) disagree. I don=E2=80=99t think PHP should =
necessarily shy away from features because they=E2=80=99re potentially =
dangerous, but I also don=E2=80=99t think it should be adding new =
features/functions that are more dangerous, just to make some weird (IMO =
bad-practice) edge cases easier.

I=E2=80=99d suggest if they insist on that bizarre naming pattern, _and_ =
want to use a literal string check, they could define an array of string =
numbers that represent their table names.

$tbls =3D [=E2=80=980=E2=80=99, =E2=80=981=E2=80=99, =E2=80=982=E2=80=99, =
=E2=80=983=E2=80=99, =E2=80=984=E2=80=99, =E2=80=985=E2=80=99, ...];

getTable(=E2=80=99table_=E2=80=99 . $tbls[$number]);


Cheers

Stephen=