Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119117
Message-ID: <cbd7dad7-8fbd-901f-7c8c-f72f44098cba@gmail.com>
Date: Tue, 13 Dec 2022 12:39:29 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.5.1
Content-Language: en-GB
To: internals@lists.php.net
References: <CAMXcktOiFH-0f0PG9cKkkVaczjNLSzQzzPUBcoLyn54X=c74og@mail.gmail.com>
 <D494A14E-0733-406B-844E-DD2D3FBB7EB4@php.net>
 <5fe0d8a9-d305-9c9d-ca36-1ca30de87b78@cubiclesoft.com>
 <38E9E8ED-F266-4EFC-8E17-DDD60F45EADA@craigfrancis.co.uk>
In-Reply-To: <38E9E8ED-F266-4EFC-8E17-DDD60F45EADA@craigfrancis.co.uk>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Revisiting RFC: Engine Warnings -- Undefined array
 index
From: rowan.collins@gmail.com (Rowan Tommins)

On 13/12/2022 10:11, Craig Francis wrote:
> undefined indexes are a classic, but once you've found them all (the tricky bit), it often makes your code better, and helps identify mistakes (similar to undefined variables).
> [...]
> The null value can come from many sources (e.g. GET/POST/COOKIE/databases)


These two examples are interesting in conjunction: $_GET, $_POST, and 
$_COOKIE will never contain null values unless you have code writing 
directly to them, because HTTP has no representation for it, only empty 
strings. So the only context where you'll get a null from them is 
because you mishandled an undefined array key, which as you say is often 
an indicator of a mistake.

Data retrieved from a database is probably the most common source of 
actual null values. Sometimes, it's important to distinguish those nulls 
from empty strings, sometimes you don't care - but that's true of 
undefined array keys as well. Which is ultimately the problem with all 
of these discussions - some people will see more benefits from catching 
extra mistakes, others will see more cost from fixing code that's lazy 
but not actually broken.

An interesting example I came across recently was a user-defined 
function for SQL string escaping (I'd like to stress legacy; I know that 
proper parameters avoid this issue). The function always expected a 
string, but didn't check that, so if given a PHP null, it would put '' 
in the SQL rather than NULL, leading to data corruption. I have 
effectively added the same notice to it as PHP has to built-in 
functions, to track down where else this might be causing problems 
without escalating to an error immediately.

Regards,

-- 
Rowan Tommins
[IMSoP]