Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116000
Message-ID: <BC03D9F6-E782-4AF8-A0FE-92287DC5F430@gmail.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_21A2F8CF-1A29-4116-A0C3-AE42CB27B364"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
Date: Wed, 8 Sep 2021 08:33:09 +0200
In-Reply-To: <CAFv4g+EwnJakuMyG5S2pUDLQSno+sRxybhGf=b5x8SappExd=w@mail.gmail.com>
Cc: PHP internals <internals@lists.php.net>
To: Craig Francis <craig@craigfrancis.co.uk>
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CAFv4g+Fs-iSHoykGhkzzJFZSd=UDB9ZGEq-aeo0VyPjqrppQKw@mail.gmail.com>
 <CAFv4g+EwnJakuMyG5S2pUDLQSno+sRxybhGf=b5x8SappExd=w@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: claude.pache@gmail.com (Claude Pache)

--Apple-Mail=_21A2F8CF-1A29-4116-A0C3-AE42CB27B364
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



> Le 7 sept. 2021 =C3=A0 11:49, Craig Francis <craig@craigfrancis.co.uk> =
a =C3=A9crit :
>=20
>=20
> Obviously I'd still like libraries to be able to protect everyone from
> introducing Injection Vulnerabilities (as the majority of programmers =
don't
> use static analysis), but that's for another day.
>=20


Hi,=20

We all want to protect from injection vulnerability, but I think there =
are better way than is_literal.

One way is to use templates, an area where PHP is ironically lagging =
behind. I suggest looking at JS tagged templates:

=
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template=
_literals =
<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Templat=
e_literals>

For example:


$qb->select('u')
   ->from('User', 'u')
   ->where('u.id =3D ' . $_GET['id']); // INSECURE
could be written as


<?php
$qb->exec `
SELECT u
FROM User u
WHERE u.id =3D %{ $_GET['id'] }
`
?>

where the part between %{ ... } is transformed into an SQL literal =
string (with delimiters "...", not just =E2=80=9Cescaping=E2=80=9D) when =
it is a string; into the SQL expression NULL when it is null; into an =
SQL subexpression if it is an object (provided by the library) that =
represents a well-formed SQL subexpression, etc.

=E2=80=94Claude


--Apple-Mail=_21A2F8CF-1A29-4116-A0C3-AE42CB27B364--