[RFC][Under discussion] Arbitrary string interpolation

Hi everyone

I'd like to start discussion on a new RFC for arbitrary string
interpolation.
https://wiki.php.net/rfc/arbitrary_string_interpolation

Let me know what you think.

That is a cool idea.
But I am not a big fan of having code in strings.
Wouldn’t this open the door to all kinds of new attacks?

Do you have an example of a new kind of attack this would allow?
The proposal doesn't enable interpolation of strings coming from
a database or user input - it only applies to string literals
directly in PHP code.

Personally I'm really looking forward to having this functionality.
Just a couple days ago I wanted to call a function in an interpolated
string, and it was really annoying to have to wrap the function in a
closure in order to use it.

If this RFC is accepted I'd be able to replace code like this:

$name = "Theodore Brown";
$strlen = fn(string $string): int => strlen($string);
echo "{$name} has a length of {$strlen($name)}.";

with

$name = "Theodore Brown";
echo "{$name} has a length of {$:strlen($name)}.";

Sincerely,

Theodore

All the other languages I looked at have support for full expressions in
their interpolation forms:

Thank you Rowan, I added the comparison of other languages to the RFC.

A large part of that is because the placeholders are positional rather
than named, so you have to keep track of which is which; but by the time
you've got named placeholders, you might as well have variable
interpolation.

I feel the same way. PHPStorm has a feature that highlights the given
expression when your cursor is placed on a %s placeholder and vice
versa. This seems to be the treatment of that symptom.

and in each case, they added expression interpolation, not just the
variable interpolation supported by Perl and PHP.

Also note that the goal of this RFC is not to encourage embedding
increasingly complex expressions in strings, but rather to allow
simple expressions like string manipulation and constants. Could you
now declare all your classes in a string? Yes. Can you create a 20'000
line PHP file? Sure. I don't think most people would support some
arbitrary cutoff for LOC either. As Rowan mentioned, most languages
allow expressions in strings and yet this is rarely abused in
practice.

Wouldn’t this open the door to all kinds of new attacks?

No. It's no different from "$userControllerString". Make sure to
sanitize user-controlled input. The expression inside the string is
parsed at compile-time, something like "{$: $userControlledString}"
where $userControlledString = 'doSomethingBad()'; will not
interpret that string and call that function but rather just result in
"doSomethingBad()".

Another thing I'd like to mention: All the heavy lifting for full
blown expression string interpolation is already there. If you look at
the implementation (https://github.com/php/php-src/pull/8256) very few
changes are necessary to make this work.

Ilija

I find that sprintf() is easier to read in most cases. One reason for this is
that the text is separated from the code.

Funnily enough, I find sprintf() harder to read for the same reason - particularly once there are more than two or three parameters, and more than a bit of punctuation between them.

A large part of that is because the placeholders are positional rather than named, so you have to keep track of which is which; but by the time you've got named placeholders, you might as well have variable interpolation.

As a silly example, I prefer this:

$sentence = "The {$adjectives[0]} {$adjectives[1]} {$nouns[0]} jumped over the {$adjectives[2]} {$nouns[1]}";

To this:

$sentence = sprintf(
'The %s %s %s jumped over the %s %s',
$adjectives[0],
$adjectives[1],
$nouns[0],
$adjectives[2],
$nouns[1]
);

I think that's partly a matter of taste, though, because I've definitely seen people happily using both styles. And there are certainly situations (like translation strings) where placeholders of some sort work better than straight interpolation.

Choice of sprintf() vs string interpolation can be more than a matter of taste, and this from someone who once greater preferred the latter.

There are (at least) two use-cases I am familiar with where using printf() and sprintf() with placeholders have benefits over string interpolation.

1.) Internationalization of human-readable strings can be more easily facilitated when the literal text is kept distinct from the interpolated values.

2.) Reduced memory allocation and string manipulation when strings are used for logging that may be discarded when logging levels are set to less than "log everything."

#fwiw

That's why I thought it was interesting to see what other languages have done. While PHP and Ruby have obvious links back to Perl, many languages which didn't start off with string interpolation have added it in later versions, e.g. C#, Scala, JavaScript, Python. Clearly there were sufficient voices in favour in each of those communities to add it; and in each case, they added expression interpolation, not just the variable interpolation supported by Perl and PHP.

I won't be too upset if this feature doesn't get added, but I do think it would be a nice addition.

Regards,

--
Rowan Tommins
[IMSoP]

--

To unsubscribe, visit: https://www.php.net/unsub.php