Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115128
MIME-Version: 1.0
References: <CAFv4g+Gv1qQ2Gtx2Qwo0Dx2Cb_gOXJ=rm7rVy+Jo89PmD-3jnA@mail.gmail.com>
 <CAEMvS4GRaqMBPn7ocBX-XU3jzrtpe+9uGfYpG10qc_iKZY80UA@mail.gmail.com>
 <03f7955c-69a8-4841-9245-449d7851e207@www.fastmail.com> <CAFv4g+EaT309KDWz63j3S7n8E58czEWTKUEw9hAvgt7s6R9eKQ@mail.gmail.com>
 <CAKws9z02yCZTb2_mw-5xUO5-QLc4jbOUcBRfJ8nFSNPP1rgO3g@mail.gmail.com>
 <CA+hqhpfUiOMLDZyXTqP+mm9jjG6v+K94Ug7K_zvuuZus_XhOaQ@mail.gmail.com>
 <CAKws9z34nTT0_CXoo4Yq7zO2CZX622has23xmfHbWjfaDrgLqA@mail.gmail.com>
 <CA+hqhpdR=W8nbWy8UBgLtKdvb_KCss5mpzturS67HhqRj4q6BQ@mail.gmail.com>
 <CAKws9z1=6fmCxJWYVfN+xKT+u=_ZTq0m7C0nZPT6LB5scbfpXQ@mail.gmail.com>
 <95D16F2E-E9DD-4964-A0E2-62E1FB0D976B@koalephant.com> <CAKws9z1M6aLMJ+T7KEAYbEu7N3ufFi8Lsqpr4GP6G06+8aG3SQ@mail.gmail.com>
 <4DE5E2EC-26D6-4D2C-95A9-B843B440EE87@koalephant.com> <CAGBsUrfar+bY+4R9Wp=WfTr5r7-Ur0pVDmNYGJTt1nh9AQ3-Zw@mail.gmail.com>
 <26037CB4-4723-4DC5-BD92-BBDC4F548E17@koalephant.com> <24E12B58-7613-4E67-852C-3312F4AE769C@newclarity.net>
In-Reply-To: <24E12B58-7613-4E67-852C-3312F4AE769C@newclarity.net>
Date: Thu, 24 Jun 2021 20:11:53 +0200
Message-ID: <CAOwTYAtnib3uWToDxHD5xwHPDq755_xYV4Xte+4UBZQcXA+kow@mail.gmail.com>
To: Mike Schinkel <mike@newclarity.net>
Cc: Stephen Reay <php-lists@koalephant.com>, php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000dbd47805c586f5ec"
Subject: Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted
From: krakjoe@gmail.com (Joe Watkins)

--000000000000dbd47805c586f5ec
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Nobody has demonstrated that "string" . int can lead to anything but
mistakes.

It CANNOT lead to injection, and that's what we're talking about, we're not
talking about a function that protects you from all possible security
concerns or bugs.

The actual definition of injection matters, when we are talking about
injection, obviously.

You can't have your own definition.

Cheers
Joe

On Thu, 24 Jun 2021 at 18:59, Mike Schinkel <mike@newclarity.net> wrote:

>
> > On Jun 24, 2021, at 6:33 AM, Stephen Reay <php-lists@koalephant.com>
> wrote:
> >
> >> On 24 Jun 2021, at 17:07, Kamil Tekiela <tekiela246@gmail.com> wrote:
> >>
> >> Hi Stephen,
> >>
> >> I believe the idea was for dynamically generate table names, or
> numbered tables/columns. E.g.
> >>
> >> function getTable(string $table){
> >>    // is_literal check here
> >> }
> >>
> >> $number =3D (int) $_GET['tableno'];
> >> if($number < 0 || $number > 10) {
> >>    throw new Exception("Invalid number");
> >> }
> >>
> >> $tablename =3D 'table_'.$number;
> >> getTable($tablename);
> >>
> >> The number is concatenated to the table name.
> >>
> >> =E2=80=94Kamil
> >
> > Hi Kamil,
> >
> > Thanks for at least trying to answer this question.
> >
> > I=E2=80=99m sure someone somewhere does that and thinks its a good idea=
. I
> respectfully (to you; probably less respectfully to someone if they tell =
me
> they do this) disagree. I don=E2=80=99t think PHP should necessarily shy =
away from
> features because they=E2=80=99re potentially dangerous, but I also don=E2=
=80=99t think it
> should be adding new features/functions that are more dangerous, just to
> make some weird (IMO bad-practice) edge cases easier.
>
> WordPress Multisite does exactly that.
>
> Whether or not them doing so is a "good idea" is irrelevant as there are =
a
> large number of website that use that mode of WordPress currently active =
on
> the web.
>
>
> > I=E2=80=99d suggest if they insist on that bizarre naming pattern, _and=
_ want to
> use a literal string check, they could define an array of string numbers
> that represent their table names.
> >
> > $tbls =3D [=E2=80=980=E2=80=99, =E2=80=981=E2=80=99, =E2=80=982=E2=80=
=99, =E2=80=983=E2=80=99, =E2=80=984=E2=80=99, =E2=80=985=E2=80=99, ...];
> >
> > getTable(=E2=80=99table_=E2=80=99 . $tbls[$number]);
>
> Some WP MS installations support millions of thousands sites. See
> WordPress.com <http://wordpress.com/>.
>
> But yes, I guess it could be possible for them to hack hack together
> 'table_983761' out of literals via a Rube Goldbergian-function, if forced
> to.
>
>
> > On Jun 24, 2021, at 6:35 AM, Stephen Reay <php-lists@koalephant.com>
> wrote:
> >
> >> On 24 Jun 2021, at 17:16, Craig Francis <craig@craigfrancis.co.uk>
> wrote:
> >>
> >> On Thu, 24 Jun 2021 at 10:55, Stephen Reay <php-lists@koalephant.com>
> wrote:
> >>
> >>> but still I have to keep asking: Why integers at all?
> >>>
> >>
> >> While I'm not a fan of this approach, there is a lot of existing code
> and
> >> tutorials that use:
> >>
> >> $sql =3D 'WHERE id IN (' . implode(',', array_map('intval', $ids)) . '=
)';
> >>
> >> $sql =3D sprintf('SELECT * FROM table WHERE id =3D %d;', intval($id));
> >>
>
> And WordPress (and I am sure a lot of other legacy code) does not support
> parameterized queries in the DB object, at least not without jumping
> through tons of hoops.  Not to mention the 60k existing open-source plugi=
ns
> and the likely million custom plugins in the wild.
>
> -Mike
> P.S. Of course we could ignore the entirety of WordPress, but that just
> does not strike me as a prudent course of action.

--000000000000dbd47805c586f5ec--