Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86825
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbPrj89krFpY-N+GoC1fW0gKL7EBXBFP5iLUJAWf3mZ1g@mail.gmail.com>
References: <CAGa2bXa9x_BK9O78N_yvAVj7M5V0UEGsy3ch-VOimaqGaKUA3w@mail.gmail.com>
	<CABBJUpeaVXXJ-JJDP+oHUamuDGwM87Myvm4_0qXAh2cZn8rg3A@mail.gmail.com>
	<CAAyV7nHo2jWSNYL-BQc-yg2SoTzOpNFvcmLNpH9vhL9w3_ab7w@mail.gmail.com>
	<CAGa2bXYRB1Mo6B9WA0knrJ6ziKukaNY18aiYzj-QfvYA+o0VVQ@mail.gmail.com>
	<CAGa2bXa0c5ducwf075MEZEE1psbn2vVHJCzX8p1KC9JJkyEe=Q@mail.gmail.com>
	<CAGa2bXbPrj89krFpY-N+GoC1fW0gKL7EBXBFP5iLUJAWf3mZ1g@mail.gmail.com>
Date: Tue, 23 Jun 2015 21:40:56 -0400
Message-ID: <CAAyV7nHX9J8_5X6geOmG9jqCbtxkobsEDBUDEcri0p-TrCRyig@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Xinchen Hui <laruence@php.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Optimizing php_html_entities()
From: ircmaxell@gmail.com (Anthony Ferrara)

Yasuo,

>
> IMHO, escape/unescape/encode/decode/conversion function is better to accept
> any types.
> HTML template may be separated script, but database code etc may not.
>
> Writing code like
>
> <?php
> declare(strict_types=1);
> $sql = 'SELECT * FROM '. pg_escape_identifier((string)$table). ' WHERE id '.
> pg_escpae_literal((string)$id).';';
> pg_query($sql);
> ?>
>
> is better to be avoided. i.e. (string) cast before passing parameter.

I agree 100%. Instead, the developer should get an error if the
parameter is not a string. Because it is an error. If you're passing
an array to `pg_escape_identifier`, you have FAR WORSE problems.
Having the function accept anything and return anything (as you're
proposing) would eliminate any ability to detect this problem.

If people blind cast, that's their problem. We shouldn't make it
harder for people to detect problems by blindly accepting anything
under the sun.

> Another example. JSON decode convert numeric to int/float
>
> <?php
> declare(strict_types=1);
> $data = json_decode($json);
> $str = mb_convert_kana((string) $data['some_data'], 'AKHV');
> ?>
>
> Are we going to enforce users to use (string) casts for conversion functions
> to switch
> strict_types=1?

No, the entire point is to have them actually validate the types.

Anthony