Re: [RFC] is_literal()
On Sat, Mar 21, 2020, at 2:13 PM, Craig Francis wrote:
> Hi,
>
> I've written up my suggestion for a is_literal() function:
>
> https://wiki.php.net/rfc/is_literal
>
> Any feedback would be appreciated.
>
> Craig
While I appreciate the intent, without an untaint() or equivalent I fear its usefulness will be
limited, or else it will get overused and thus cut off numerous entirely valid situations.
Eg, there's plenty of very good reasons to put a template string into the database rather than
a file literal. Or to build an SQL query dynamically in ways that an is_literal check would not
allow, at least not without an absurdly complex query builder.
Without a way to flag "yes, I know this was built dynamically but I've vetted it,
it's OK" on a value, I fear such a check will either be unuseful or counter-productive.
--Larry Garfield
Thread (13 messages)