Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117436
MIME-Version: 1.0
References: <CAPyj-LCXYjsjtDr1zPmH6t37pQS7aeGACG6kCex=fnsEJmNmVg@mail.gmail.com>
 <10558027.nUPlyArG6x@arnaud-t490> <b8273a1b-6212-9c43-1d3a-49d1e805a0e2@gmail.com>
In-Reply-To: <b8273a1b-6212-9c43-1d3a-49d1e805a0e2@gmail.com>
Date: Sun, 27 Mar 2022 18:41:03 +0200
Message-ID: <CAPyj-LCxaBpKO4HNM11JU1VUtKmDUcrasFtUrDTRAcmwhnpwOQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC][Under discussion] Arbitrary string interpolation
From: tovilo.ilija@gmail.com (Ilija Tovilo)

> All the other languages I looked at have support for full expressions in
> their interpolation forms:

Thank you Rowan, I added the comparison of other languages to the RFC.

> A large part of that is because the placeholders are positional rather
> than named, so you have to keep track of which is which; but by the time
> you've got named placeholders, you might as well have variable
> interpolation.

I feel the same way. PHPStorm has a feature that highlights the given
expression when your cursor is placed on a %s placeholder and vice
versa. This seems to be the treatment of that symptom.

> and in each case, they added *expression* interpolation, not just the
> *variable* interpolation supported by Perl and PHP.

Also note that the goal of this RFC is not to encourage embedding
increasingly complex expressions in strings, but rather to allow
simple expressions like string manipulation and constants. Could you
now declare all your classes in a string? Yes. Can you create a 20'000
line PHP file? Sure. I don't think most people would support some
arbitrary cutoff for LOC either. As Rowan mentioned, most languages
allow expressions in strings and yet this is rarely abused in
practice.

> Wouldn=E2=80=99t this open the door to all kinds of new attacks?

No. It's no different from `"$userControllerString"`. Make sure to
sanitize user-controlled input. The expression inside the string is
parsed at compile-time, something like `"{$: $userControlledString}"`
where `$userControlledString =3D 'doSomethingBad()';` will *not*
interpret that string and call that function but rather just result in
`"doSomethingBad()"`.

Another thing I'd like to mention: All the heavy lifting for full
blown expression string interpolation is already there. If you look at
the implementation (https://github.com/php/php-src/pull/8256) very few
changes are necessary to make this work.

Ilija