Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69645
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.53 as permitted sender)
Message-ID: <526022E1.1040406@gmail.com>
Date: Thu, 17 Oct 2013 18:48:17 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1
MIME-Version: 1.0
To: Pierre Joye <pierre.php@gmail.com>
CC: PHP Internals <internals@lists.php.net>
References: <525C631E.1050008@gmail.com>	<1381853515.3980.195.camel@guybrush>	<526002B4.9010808@gmail.com> <CAEZPtU7iJwwaY8xVb5a9emwKx0Bie_Xu2F_2AuYU-ijtGiGfZA@mail.gmail.com>
In-Reply-To: <CAEZPtU7iJwwaY8xVb5a9emwKx0Bie_Xu2F_2AuYU-ijtGiGfZA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Proposal to deprecate create_function()
From: rowan.collins@gmail.com (Rowan Collins)

On 17/10/2013 16:47, Pierre Joye wrote:
> On Thu, Oct 17, 2013 at 8:31 AM, Rowan Collins <rowan.collins@gmail.com> wrote:
>> Yes, I agree that there is no trvial solution which is 100% feature 
>> (and bug) compatible with create_function(). However, I think the 
>> more important question is whether there are any particular *use 
>> cases* which can't be easily migrated to a different mechanism. 
> That's the actual question, why should they?
>
>> My gut feel is that at least 95% of uses of create_function are to create
>> dynamic callbacks for usort, preg_replace_callback, array_filter, etc. For
>> these uses, the implementation as an eval() is a liability, and
>> reimplementing with real closures is trivial (assuming no need to run on
>> <=5.2).
> Yes, as many other new features allow cleaner codes. However I do not
> see this case as good enough to add more deprecated notices to
> perfectly valid codes.

I guess to me it seems much the same as deprecating the /e modifier in 
preg_replace: code using it right now largely works, but it presents a 
security risk that many users probably don't appreciate.

I wasn't subscribed when that was being discussed, so if there are 
points from that discussion which would be pertinent here, I'd welcome 
links/summaries.

The only real difference I can see with create_function is that it 
is/was more widely used; is that your concern, or do you see a 
fundamental difference between the two situations?

-- 
Rowan Collins
[IMSoP]