Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69646
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <526022E1.1040406@gmail.com>
References: <525C631E.1050008@gmail.com>
	<1381853515.3980.195.camel@guybrush>
	<526002B4.9010808@gmail.com>
	<CAEZPtU7iJwwaY8xVb5a9emwKx0Bie_Xu2F_2AuYU-ijtGiGfZA@mail.gmail.com>
	<526022E1.1040406@gmail.com>
Date: Thu, 17 Oct 2013 10:52:06 -0700
Message-ID: <CAEZPtU53CH-gGZK7kJnYrPu=VAc0-M-4DUryDBH7TgcEJ=Y6QA@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Proposal to deprecate create_function()
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Oct 17, 2013 at 10:48 AM, Rowan Collins <rowan.collins@gmail.com> wrote:
> On 17/10/2013 16:47, Pierre Joye wrote:
>>
>> On Thu, Oct 17, 2013 at 8:31 AM, Rowan Collins <rowan.collins@gmail.com>
>> wrote:
>>>
>>> Yes, I agree that there is no trvial solution which is 100% feature (and
>>> bug) compatible with create_function(). However, I think the more important
>>> question is whether there are any particular *use cases* which can't be
>>> easily migrated to a different mechanism.
>>
>> That's the actual question, why should they?
>>
>>> My gut feel is that at least 95% of uses of create_function are to create
>>> dynamic callbacks for usort, preg_replace_callback, array_filter, etc.
>>> For
>>> these uses, the implementation as an eval() is a liability, and
>>> reimplementing with real closures is trivial (assuming no need to run on
>>> <=5.2).
>>
>> Yes, as many other new features allow cleaner codes. However I do not
>> see this case as good enough to add more deprecated notices to
>> perfectly valid codes.
>
>
> I guess to me it seems much the same as deprecating the /e modifier in
> preg_replace: code using it right now largely works, but it presents a
> security risk that many users probably don't appreciate.
>
> I wasn't subscribed when that was being discussed, so if there are points
> from that discussion which would be pertinent here, I'd welcome
> links/summaries.
>
> The only real difference I can see with create_function is that it is/was
> more widely used; is that your concern, or do you see a fundamental
> difference between the two situations?

I do. create_function is used for many very valid use cases, safely,
much more than /e ever was (and its security impact was much bigger).
Deprecating it does not help us nor our users at this stage.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org