Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115109
To: internals@lists.php.net
References: <CAFv4g+Gv1qQ2Gtx2Qwo0Dx2Cb_gOXJ=rm7rVy+Jo89PmD-3jnA@mail.gmail.com>
 <CAEMvS4GRaqMBPn7ocBX-XU3jzrtpe+9uGfYpG10qc_iKZY80UA@mail.gmail.com>
 <03f7955c-69a8-4841-9245-449d7851e207@www.fastmail.com>
 <CAFv4g+EaT309KDWz63j3S7n8E58czEWTKUEw9hAvgt7s6R9eKQ@mail.gmail.com>
 <CAKws9z02yCZTb2_mw-5xUO5-QLc4jbOUcBRfJ8nFSNPP1rgO3g@mail.gmail.com>
 <CA+hqhpfUiOMLDZyXTqP+mm9jjG6v+K94Ug7K_zvuuZus_XhOaQ@mail.gmail.com>
 <CAKws9z34nTT0_CXoo4Yq7zO2CZX622has23xmfHbWjfaDrgLqA@mail.gmail.com>
 <CA+hqhpdR=W8nbWy8UBgLtKdvb_KCss5mpzturS67HhqRj4q6BQ@mail.gmail.com>
 <CAKws9z1=6fmCxJWYVfN+xKT+u=_ZTq0m7C0nZPT6LB5scbfpXQ@mail.gmail.com>
 <95D16F2E-E9DD-4964-A0E2-62E1FB0D976B@koalephant.com>
 <CAKws9z1M6aLMJ+T7KEAYbEu7N3ufFi8Lsqpr4GP6G06+8aG3SQ@mail.gmail.com>
 <4DE5E2EC-26D6-4D2C-95A9-B843B440EE87@koalephant.com>
 <CAFv4g+Gb6D2dEn=n-9Mp9cMY+9G+HuppOG3YhBRJ5h_vKS0vOA@mail.gmail.com>
 <B19D4D34-4E75-4AB0-A1D0-A591D56D0F50@koalephant.com>
Message-ID: <ea9d3a85-2c35-b328-94fa-7e563d027c08@gmail.com>
Date: Thu, 24 Jun 2021 12:09:19 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <B19D4D34-4E75-4AB0-A1D0-A591D56D0F50@koalephant.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted
From: rowan.collins@gmail.com (Rowan Tommins)

On 24/06/2021 11:35, Stephen Reay wrote:
>> On 24 Jun 2021, at 17:16, Craig Francis <craig@craigfrancis.co.uk> wrote:
>>
>> On Thu, 24 Jun 2021 at 10:55, Stephen Reay <php-lists@koalephant.com> wrote:
>>
>>> but still I have to keep asking: Why integers at all?
>>>
>>
>> While I'm not a fan of this approach, there is a lot of existing code and
>> tutorials that use:
>>
>> $sql = 'WHERE id IN (' . implode(',', array_map('intval', $ids)) . ')';
>>
>> $sql = sprintf('SELECT * FROM table WHERE id = %d;', intval($id));
> Yeah you’ve said this about a dozen times now. Parameterisation exists. Query builders that do this already using parameterisation, exist.


I think it's clear that a conversation is going round in circles if you 
are complaining both that you haven't had an answer to your question, 
and that you've had the same answer too many times.

If you understand the answer but disagree with it, there is nothing more 
to be said.

Unless you have a new point to make, I think it's probably best to 
"agree to disagree" at this point, particularly as the discussion seems 
to be getting heated and personal, which is not fun for anyone.

Regards,

-- 
Rowan Tommins
[IMSoP]