Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86059
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain basereality.com from 209.85.213.53 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZAY_9qx9D+K11ApJH9DKzTvxze+=E5=rVhQj_OaGfxGQ@mail.gmail.com>
References: <CAGa2bXYzp3XimLXxC+Py2t1DWhCfX8coTdYHzf6zEiKdxA7r8Q@mail.gmail.com>
	<55401F31.9030703@gmail.com>
	<CAObuZduZBM0GyWJMA1Fd7eCgPE4vFFZrrhpREQ50a4QJhG6Nvg@mail.gmail.com>
	<CAGa2bXar_oXrsPAErNx5BUdkFAy-p8-D0tfhc3pAnDTGBGJJ7Q@mail.gmail.com>
	<55416849.9010808@gmail.com>
	<CAGa2bXbkCx2Nqb9YBut3id4N=nhjLBGPN8Ucrx7R6mRnGjB2og@mail.gmail.com>
	<554176D6.2030007@gmx.de>
	<CAGa2bXaPjvkFYtkhRM1JisSvxgR0v8adkD_P_zkUng4xfBWFHg@mail.gmail.com>
	<55418CBE.6050609@gmail.com>
	<CAGa2bXZAY_9qx9D+K11ApJH9DKzTvxze+=E5=rVhQj_OaGfxGQ@mail.gmail.com>
Date: Thu, 30 Apr 2015 03:02:37 +0000
Message-ID: <CA+kxMuQpndb0ymLPQyO_sHti8eYr3JN_pdGt=F3dpSmpsju-eg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Rowan Collins <rowan.collins@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Adding "numeric" type hint
From: danack@basereality.com (Dan Ackroyd)

On 30 April 2015 at 02:17, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Current PHP: Search query failure.
> New PHP type hint: Fatal error because foreign key is out of PHP int range.

There may be some confusion; NikiC is still doing some work to tidy up
the EngineExceptions. When that is finished passing a variable of the
wrong type will give a TypeException.

> If user are using type hints everywhere, it may be limited to attackers
> seeing fatal errors. If not, attacker can succeed system wide DoS attack by
> simple operation.

Passing in invalid primary keys should never result in a DoS
attack...and I have no idea why you think it would be due to the
presence or absence of scalar type hints.


Yasuo wrote:
> How many of us are expected that
> mydb_find_by_id(INT_MAX+1);
> Note: INT_MAX+1 is pseudo integer string value.

Well currently it isn't:

var_dump(PHP_INT_MAX + 1);
float(9.2233720368548E+18)


Yasuo wrote:
> How about have "numeric" type hint that accepts any format/class(GMP)
> of numeric values?
>
> The issue is that weak mode type hint is *not* weak at all. It forces to
> have machine native type rather than it's data form.

So what you're suggesting is adding a numeric type that acts like GMP
and allow arbitrary precision arithmetic on values? Isn't that just
GMP? Except you'd need to convert the variable to be 'numeric' before
doing any operation on it i.e. something like:

$x = (numeric)INT_MAX;
mydb_find_by_id($x+1);

Unless you're also suggesting replacing PHP's current maths operations...


cheers
Dan