Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128444
Content-Type: text/plain; charset=utf-8; format=flowed
Message-ID: <1754681940016.3857794334.1617046696@yahoo.de>
To: larry@garfieldtech.com, php internals <internals@lists.php.net>
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 8.5
Date: Fri, 08 Aug 2025 20:22:33 +0000
In-Reply-To: <b4034ea3-e7a0-498f-8496-00a30ffda809@app.fastmail.com>
References: <b4034ea3-e7a0-498f-8496-00a30ffda809@app.fastmail.com>
User-Agent: Vivaldi Mail/7.5.3735.58
Content-Transfer-Encoding: 7bit
Precedence: list
MIME-Version: 1.0
From: hanskrentel@yahoo.de (Hans Krentel)




On Tuesday 29 July 2025 21:43:39 (+02:00), Larry Garfield wrote:

 > On Tue, Jul 29, 2025, at 2:22 PM, Hans Krentel wrote:
 > > On Monday 14 July 2025 15:29:31 (+02:00), Larry Garfield wrote:
 > 
 > >> Is their use for quick hacky scripts worth the cost of reserving a 
symbol that could be repurposed for something else more generally useful in 
the future?  (Not immediately of course, but eventually.)
 > >> 
 > >> --Larry Garfield
 > 
 > *snip*
 > 
 > > My educated guess is that I don't need to explain the benefits of 
 > > _template literals_ over ordinary PHP string literals for Larry, but 
 > > for those who are curious, this is inspired by EcmaScript and you can 
 > > try it out in your browser or read on MDN about it. 
 > 
 > Indeed, that's the sort of future reuse I was thinking of as well.


Yes, I have hoped, so good to read!

Do you know by chance this has gotten some movement towards that form of 
reuse in the past? I'd be interested.

 > But having this be a template:
 > 
 > $foo = tpl`Something $here`;
 > 
 > But this run a shell command:
 > 
 > $foo = `Something $here`;
 > 
 > Strikes me as a security nightmare waiting to happen.


Oh, that was not intended. I need your precise eyes for this, and starring 
fearfully at the snakes is certainly not good for that. Sorry!

That suggestion is the migration form. Naturally, this needs to be properly 
packaged, you can't tell users that template literals are there and leave 
them in the un-tagged form as command substitution. Who would do that 
seriously?

Users of command substitution would have the opportunity to convert their 
backticks into a predefined, tag-limited form of a template literal. That 
is fool-proof, and it can't be conflated.

Therefore, there is no unguarded use of command substitution, this is 
inserting into the transition for existing users that are using backticks 
as they already do today.

My thought in the margin was that of a birthday present for the 25th of the 
backticks and users of the language (the global 50th is in 2029.)

Best

-- hakre