Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61211
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.170 as permitted sender)
Message-ID: <5000990F.30105@gmail.com>
Date: Fri, 13 Jul 2012 23:54:23 +0200
User-Agent: Thunderbird
MIME-Version: 1.0
To: Ryan McCue <lists@rotorised.com>
CC: internals@lists.php.net
References: <CAAyV7nFRT24rksh6iDWxstfQwJ4+KdEC7Zs6EC8wBtJ8Zorf7w@mail.gmail.com> <CAKZjf5ROuK-Kt1GAPJm0A2-mksw2kJ7C4bOMtz1+dPrYheqzSA@mail.gmail.com> <CAAyV7nFBk1j20LiYvz--2K+BPNgm6_WEGPtY0t5oC57PhCupVg@mail.gmail.com> <4FFFF84D.9070202@rotorised.com>
In-Reply-To: <4FFFF84D.9070202@rotorised.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [PROPOSED] password_hash RFC - Implementing simplified
 password hashing functions
From: keisial@gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)

On 13/07/12 12:28, Ryan McCue wrote:
> Somewhat off-topic, but is there a reason why not? It seems to me that
> introducing a new API without using PHP's best method of error handling
> (IMHO) is a little silly.
I don't really trust exception throwing near password-managing functions.
Consider the following:

class UserLogin {
    var $loggedIn = false;
    function login() {
        $row = SELECT * FROM user WHERE username =
escape_string($_POST['user']) ;
        $this->checkPassword($row->password);
    }
    function checkPassword($pw_hash) {
        if (password_verify($_POST['password'], $pw_hash)
            $this->loggedIn = true;
    }
}

The codebase does no global exception handling (because it doesn't throw
exceptions itself),
and also nobody configured the server not to show errors/exceptions
(some say it was
purposely setup to show them).
password_verify() "errors" if the parameters are not strings or the hash
doesn't match a
known hash format.
Which kind of error should you use? errors or exceptions? Provide a
reasoned answer.