Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86821
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.177 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXa0c5ducwf075MEZEE1psbn2vVHJCzX8p1KC9JJkyEe=Q@mail.gmail.com>
References: <CAGa2bXa9x_BK9O78N_yvAVj7M5V0UEGsy3ch-VOimaqGaKUA3w@mail.gmail.com>
 <CABBJUpeaVXXJ-JJDP+oHUamuDGwM87Myvm4_0qXAh2cZn8rg3A@mail.gmail.com>
 <CAAyV7nHo2jWSNYL-BQc-yg2SoTzOpNFvcmLNpH9vhL9w3_ab7w@mail.gmail.com>
 <CAGa2bXYRB1Mo6B9WA0knrJ6ziKukaNY18aiYzj-QfvYA+o0VVQ@mail.gmail.com> <CAGa2bXa0c5ducwf075MEZEE1psbn2vVHJCzX8p1KC9JJkyEe=Q@mail.gmail.com>
Date: Wed, 24 Jun 2015 07:24:26 +0900
Message-ID: <CAGa2bXbPrj89krFpY-N+GoC1fW0gKL7EBXBFP5iLUJAWf3mZ1g@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: Xinchen Hui <laruence@php.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113bcfa0ba9987051936dc50
Subject: Re: [PHP-DEV] Optimizing php_html_entities()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113bcfa0ba9987051936dc50
Content-Type: text/plain; charset=UTF-8

Hi all,

On Wed, Jun 24, 2015 at 6:51 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> I got it.
>
> On Wed, Jun 24, 2015 at 6:41 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> On Wed, Jun 24, 2015 at 12:21 AM, Anthony Ferrara <ircmaxell@gmail.com>
>> wrote:
>>
>>> In addition, this breaks the contract, specifically when using scalar
>>> types. Because you're no longer going to error when the contract is
>>> broken (considering htmlspecialchars is documented as string:string).
>>>
>>
>> What do you mean by "break the contract".
>> "string" parameter is not a requirement/contract.
>> htmlspecialchars/htmlentities
>> just converts param to string. The patch does not change anything as you
>> can
>> see it from the phpt results.
>>
>
> [yohgaki@dev github-php-src]$ cat ../t.php
> <?php
> declare(strict_types=1);
>
> var_dump( htmlspecialchars(123) );
>
> [yohgaki@dev github-php-src]$ ./php-bin ../t.php
>
> Fatal error: Uncaught TypeError: htmlspecialchars() expects parameter 1 to
> be string, integer given in /home/yohgaki/workspace/ext/git/oss/
> php.net/t.php:4
> Stack trace:
> #0 /home/yohgaki/workspace/ext/git/oss/php.net/t.php(4):
> htmlspecialchars(123)
> #1 {main}
>   thrown in /home/yohgaki/workspace/ext/git/oss/php.net/t.php on line 4
>
>
> I think this is massive breakage. It only happens in strict mode, though.
>

IMHO, escape/unescape/encode/decode/conversion function is better to accept
any types.
HTML template may be separated script, but database code etc may not.

Writing code like

<?php
declare(strict_types=1);
$sql = 'SELECT * FROM '. pg_escape_identifier((string)$table). ' WHERE id
'. pg_escpae_literal((string)$id).';';
pg_query($sql);
?>

is better to be avoided. i.e. (string) cast before passing parameter.

Another example. JSON decode convert numeric to int/float

<?php
declare(strict_types=1);
$data = json_decode($json);
$str = mb_convert_kana((string) $data['some_data'], 'AKHV');
?>

Are we going to enforce users to use (string) casts for conversion
functions to switch
strict_types=1?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113bcfa0ba9987051936dc50--