« first day (3444 days earlier)      last day (1488 days later) » 

12:01 AM
PHP 8 - add an ini setting that controls what happens when a float to string cast is called. ini setting of 'legacy' => deprecation notice is raised, and current shitty behaviour is done. ini setting of 'sane' => locale independent conversion is done.

PHP 8.1 - remove that ini setting
s/deprecation notice is raised/deprecation notice is raised if conversion is done with none C locale/
 
I thought we'd collectively agreed that engine altering ini settings were punishable by death?
 
I suppose that's an option, will add it to the "Alternate approaches" Section
Well it's temporary
 
Sep 22 '19 at 15:35, by Danack
@MarkR Let me put it like this. There are two different levels for advice about 'etiquette'. There are improvements that aim to increase the likelihood that person will want to interact with you in the future. People don't have to take these, but then other people might choose to not interact with that person. I was suggesting quite strongly, that using violent imagery in a conversation is something I personally don't like, and that I'm less likely to interact with someone that does that.
 
Like a for the span of a minor release cycle that should be alright
 
well deprecations typically come on a major... you might be stuck with it for another 5 or 6 years
 
12:03 AM
yeah. The problem with ini settings isn't how terrible they are - it's that different libraries might need different settings.
 
Well, this specific timeline would be voted on
 
And trying to manage that is impossible. But for app level ini settings - like the session handler to be used, they aren't completely terrible.
tbh, I'd suggest not adding that to the RFC now, but instead wait for the wailing and gnashing of teeth, and then 'compromise'.
 
Sure seems like a better idea :)
 
providing an upgrade path for people who currently have this in their app - and there will be quite a few in Europe - is something probably worth doing, as otherwise it become a big barrier to upgrading to 8.
But also there might be other ways of doing it - other than ini settings.
 
ini flag, global state or fine grained define are the only options really, all of them fairly unpleasant solutions
 
12:06 AM
And also, yeah, having an ini setting that will be removed within a minor release is a much lower burden than adding one that will be there until the end of time.
 
INI and global state both have the problems of needing to handle both cases regardless, fine grained declare doesn't appear to have much support as a general thing and would have the same hassles when crossing between file contexts
dedicated error handler maybe?
if (EG(double_convert_error_handler) != NULL) {
// test if it would throw a notice here but instead send it to the error handler?
}

Only suggest it as it would give an easy opportunity to throw
 
1 message moved to Trash can
yeah, don't do that.
and hello.
Well, bye then.
 
Charming fellow.
 
1 message moved to Trash can
 
12:23 AM
Anyway, hyperbolous imagery aside, I see the benefit of a flag to warn people, but if you do that for just 1 release I think you'd struggle to pass it for the simple reason that people are going to whine that they might not necesarally upgrade to 8.0, and might go straight from 7.4 to 8.1, and you've taken the flag away they needed.
 
 
1 hour later…
1:33 AM
posted on March 20, 2020

Before you give me too hard of a time, things aren’t truly horrific here… yet. I know many of you are already affected by COVID-19. Personally, indirectly, and economically. Note that I do take this whole thing seriously. Very seriously. Deadly seriously. So when things get scary, my options are typically to go cry in the corner, or crack my little jokes. To the best of my knowledge, no

 
 
6 hours later…
7:49 AM
<?php echo '£', floatval(substr($order[24], 0)) * floatval(substr($order[25], 2)); ?> is my code, how do i modify it to get it to display the result as 0.50 as its currently showing 0.5 ? thanks
 
8:31 AM
morning
 
Sorted my issue with number_format :-)
 
8:48 AM
@GlenKeybit Beware of using floats for monetary values (or any value where precision is important). Read up on the Money Pattern for one alternative. See also NumberFormatter from the Intl extension.
 
9:06 AM
@AllenJB Many thanks for the tips
 
9:16 AM
I read yesterday what Ben wrote in response to "no" vote on SapiRequest and SapiResponse RFC and wanted to know better what the WSGI is actually.
I was reading WSGI spec the PEP-3333 and was thinking if this could be applicable to PHP as a new SAPI which works as an HTTP server lets call it php-http for now and on a first request loads PHP stcript from argument for eg. index.php
Then expectes a return value to be callable, the collable receives similar to WSGI the $_ENV+$_SERVER as an environment and a callable to ba invoked on response start (still similar to WSGI) this approach is quite convenient and easy to apply due to lots of similarities - the environment arrays stays the same as they're now in general.
Now the callable return type should fullfil the union null|string|iterable|\Generator|resource and work like that:
1. on `return null` send a response with optionally set headers and `Content-Length: 0`
2. on `return string` send a response similar to above with `Content-Length: strlen(string)`
3. on `iterable` on HTTP/1.0 resolve and buffer the output of iteration and then send headers with counted `Content-Type` and when using HTTP/1.1 iterate and send chunked response
4. on `Generator` if request headers had `Expect: 100-continue` then send `100 Continue` then reaching first `yield` which returns the input if applicable then read write response output in HTTP/1.1 chunked response nammer
A `php-http` SAPI therefore must take care of compression and transfer encoding.
IMO this could be the easiest way to introduce long running applications and if needed could fallback and be backward compatible if the script for eg. `index.php` use `header()|setcookie()|die()|echo|print*()|exit` then. But dunno if that shouldn’t be then left to FPM as it is now and use FCGI protocol.
Dunno if that makes sense, but I think it would be the easiest way to convert PHP scripts which don't work with request/response objects and that doesn't require any additional interfaces etc.
Also dunno how/if it would/shoudl work with HTTP/2
I would leave the SSL etc. to the reverse proxies which does that better
And would leave static files serving to other http servers giving the application the ability to serve resources which require some logic/authorization/etc.
Any thoughts?
Frameworks would be able to reuse their http request/response implementations still vuilding them from environment, the only part changes is call for sending headers and output of response if needed.
Which means they can implement HttpKernel od PSR middlewares - whatever applicable here.
<?php // index.php
return static function(array $environment, callable $response) {
    // serving json response
    if ($environment['PATH_INFO'] === '/') {
        $response(200, ['content-type' => 'application/json']);
        return json_encode(['status' => 'OK']);
    }
    // serving static file
    if (stripos($environment['PATH_INFO'], '/assets/') === 0) {
        $response(200);
        return fopen(__DIR__ . '/public' . $environment['PATH_INFO'], 'rb+');
    }
    // simple /echo server
That could be the simplest app
This approach is not compatible with any existing request/response implementation and doens't declare nor require any interfaces leaving that to userland how the app/middlewares etc. will be implemented
Also doesn't expose any $_GET, $_POST, $_COOKIE, $_SESSION nor $_FILES and leaves that to the application to handle
The biggest difference it is.
Thats challenging but...
 
9:55 AM
Python users handled that with middlewares
 
 
1 hour later…
10:59 AM
@brzuchal A new sapi is the way to go, to clean up all the legacy stuff related to the weird stuff php does with headers. I don't have time to read and understand the wsgi stuff, so can't comment on it in detail, but that feels like the right level of abstraction. The idea of putting the PSR level abstractions into core still makes me roll my eyes quite hard.
 
11:20 AM
Okay so, I received a quite weird voicemail spam in chinese today. Does anyone know a proficient Chinese speaker they trust that I could send a recording to, to ask them to translate it?
 
@Danack Thx for sharing your opinion. It means I'm not the only one who think that providing core OO API for req/res is nearly impossible and introducing a simplest way for handling req/res in long running process could be a win win.
 
11:47 AM
@Girgias Thanks! I didn't want to put it in the list yet because then the RFC bot on Twitter finds it and didn't want to spoil it ^^
 
11:59 AM
o/
 
12:18 PM
hah, now being haggled by Cal for voting no on wiki.php.net/rfc/request_response on twitter... twitter.com/CalEvans/status/1241337582040072194
 
Also love the initial reply to the bot post as to why we don't want it. I personally want a better way than superglobals, but I'd rather have a complete overhaul than doing this weird copy pasta from something in userland and segregating it even more :/
 
@Girgias @Derick what do you think about WSGI way in short described above by me?
As a general approach without going too deep into the details for now.
 
I mostly agree with @Girgias. I think it would be very beneficent to have a better request/response abstraction in core. The current situation feels a pain in the... bottom.
 
@brzuchal I suspect long-running processes are going to be the future of PHP power-apps
 
@brzuchal don't really know about WSGI as I don't use Python that much, but from what you said seems good
 
12:29 PM
From what I've understood reading the WSGI carefully for around 3h what I wrote is nearly the WSGI way of handling req/res
 
 
1 hour later…
1:36 PM
moin
 
o/
 
I wish imgur could do videos because I have so many excellent, somewhat nihilistic video memes from various whatsapp groups right now
@Danack yes
whatsapp me, number hasn't changed for 20 years so if you have a number it will be the right one
 
2:03 PM
@Danack I've received a couple of those.
@DaveRandom convert them to gifv
 
2:14 PM
@cmb Can I ask you to have a quick look at the examples of wiki.php.net/rfc/locale_independent_float_to_string ? Are they correct?
pinging @Girgias :)
 
@MátéKocsis the first example should say what it's showing. just something like "This is the current behaviour of how locale affects output"
 
cmb
@MátéKocsis yes, the examples are correct. I'm not 100% sure what to do with printf(), though. I think sticking with %f being locale aware, and using %F if that behavior is not desired, looks okay to me.
 
@cmb What I'm not exactly sure is if bugs.php.net/bug.php?id=79317 another case?
 
cmb
Also note that the compile time optimization (3.14+"") is OPcache only.
 
Ah I seen, then they are the same, thanks!
 
cmb
2:19 PM
bug #79317 is about that OPcache compile time optimization; if we'd stick with locale-dependent float to string cast, that would likely have to be disabled.
 
Thank you all for the input! Will update the examples a bit later :)
 
@brzuchal What's WSGI?
 
2:35 PM
but it's apparently nice as it allows different python apps to talk to each other efficiently, as well as be able to drop in an app into ....whatever python calls the equivalent of Java servlets.
is my understanding.
 
3:29 PM
Morgens
 
cmb
\o
 
o/
 
4:03 PM
RFC chances guide - "This guide seeks to help people understand the attitude the PHP internal participants take when evaluating RFCs, and what factors are likely to make RFCs be less or more likely to pass." Feed back please.
3
 
4:17 PM
@Danack I would probably add something to the tune of: (huge) BC for no real gain / benefit
to "less likely to pass"
 
"See people's suggestions in /r/php for examples"
@PeeHaa actually, what's a good example of that? I know there have been some, but my mind is blank.
 
removing short open tags? ;-)
 
needle <-> haystack order or consistency_in_naming of strfuncnames
@Derick That actually has a benefit :-)
 
but no "real" benefit ;-)
 
I'll also add 'trolling for the lulz' to the list.
 
4:35 PM
SYntax that requires to make parser context sensitive
 
@beberlei Did someone suggest that? I think my mind has blocked that memory if they did....
 
@ for attributes for example
 
@Derick python.org/dev/peps/pep-3333 Python has a standardized way of handling req/res which allows to run multiple apps
on the same server. Their rationale section explains that they wanted to split framework choose from server but the handling works like you're passing a handler which receives environ similar to CGI hash table and a callback to use when setting response status code and headers, then return of that callback can be string iterabke or generator for capturing response content then after response send the callback is used to handle further requests
 
@Danack <3
> doing the the work
 
@brzuchal There is a PSR for this. PHP shouldn't be taking an opinionated API and put it in core where it's harder to maintain.
 
nitpicking "This reason is one of the reasons" -> "This is one of the reasons"
 
@PeeHaa thanks, but also: youtube.com/watch?v=B2EI65ZEqYQ
 
5:01 PM
You never disappoint when it comes to youtube links :P
 
@Derick that's why I was thinking of http sapi which executes PHP script to get callback for handling req/res in long running process. The PSR-15 is nice but forces to use OO API which will never happen to get into the core and is not suitable for small things anymore
 
Surprise - yes! Disappoint - only my parents.
 
Brother?
 
@brzuchal I think the main biggie with a handler loop approach is more to do with the output than the input IMO. In terms of input we could (theoretically) just pass an array which had all the expected keys in it: $request[ '_GET' => [ ... ], '_POST' => [ ... ] ] etc
 
@MarkR it's a detail how they're passed IMO. The biggest advantage could be reading and writing through we socket by simply returning a generator
 
5:39 PM
someone here who can help me?
 
> Support group for those afflicted with PHP. Don't ask to ask, just ask.
 
ok, then

I want to get an array of strings which are between two strings in PHP. Example:

Hello my name is @kahveciderin i love @php

The first character is @ and the second is space .

The output should be an array containing the words kahveciderin and php.

If it is the end of the string while scanning for the second character, it should include that one too.
how can i accomplish this?
 
regex.
 
@kahveciderin try with preg_match_all and proper PCRE regexp
 
5:41 PM
lemme try
 
preg_match_all('/@[^ ]+/', 'Hello my name is @kahveciderin i love @php', $matches);
 
yay ty ill tyr
try*
it works tysm
 
np, and if you want to consider other characters, such as tabs, try '/@\S+/'
 
yay ty
 
@Derick, thanks again for your PHP 7.4 talk in Bristol last week. Following on from our discussion afterwards, I've put together an RFC for the is_literal() function. If you have the time, could you see if it's a good start. Thanks.

https://wiki.php.net/rfc/is_literal
 
5:53 PM
heres me again sorry for interrupting but now i want to replace that text.
$string = "Hello @kahveciderin ! Welcome to our @IELestiri";


preg_match_all('/@\S+/', $string, $matches);

foreach($matches[0] as $match){
$mention = preg_replace("/[*@]/", "", $match);

$resultasdasd = mysqli_query($db,"SELECT id FROM users WHERE username='$mention'");
while ($rowas = mysqli_fetch_array($resultasdasd, MYSQLI_ASSOC)) {
$id = $rowas['id'];
}

echo "<a href=\"/account/pages/index.php?id=$id\">$mention</a><br>";
}
this is my current code and now i want to replace @kahveciderin and @IELestiri with the result of the last echo
 
@kahveciderin Learn about prepared statementsplease
 
hard for me sorry if it is too easy i started php like 2 months ago and made a social networking site so i really need to finish it
 
No you need to fix your security holes first
2775
Q: How can I prevent SQL injection in PHP?

Andrew G. JohnsonIf user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's because the us...

 
ikr there are tons of them as i dont do anything against it
aand how can i accomplish the thing i want?
pls mention when answering
 
If you fix your security issues I will personally help you
 
6:08 PM
-_-
 
$content = 'Hello my name is @kahveciderin i love @php';

$html_content = htmlentities($content);

preg_match_all('/@(\S+)/', $content, $matches, PREG_SET_ORDER);

$usernames = array_column($matches, 1);

if (count($usernames) > 0) {

$in_sql = implode(',', array_fill(0, count($usernames), '?'));

$sql = 'SELECT id, name FROM user WHERE name IN (' . $in_sql . ')';

$statement = mysqli_prepare($db, $sql);

$params = [str_repeat('s', count($usernames))];
foreach ($usernames as $username) {
$params[] = &$username; // Must be a reference.
 
$html_content = htmlentities($content); o.O
 
Yep, because we will be spitting out some HTML at the end... and because I have no idea what templating system is in play (the echo suggests none), then we encode it all :-)
 
Warning: call_user_func_array() expects parameter 1 to be a valid callback, first array member is not a valid class name or object in /var/www/html/testing/getbetween.php on line 25

Fatal error: Uncaught Error: Call to a member function execute() on bool in /var/www/html/testing/getbetween.php:27 Stack trace: #0 {main} thrown in /var/www/html/testing/getbetween.php on line 27
 
Always escape on output not input
 
6:21 PM
I am
 
And please use htmlspecialchars :P
 
no need
 
@CraigFrancis No you are not
 
Sorry kahveciderin, check the name, should be username
 
ok thanks
 
6:22 PM
You are first butchering data -> then processing it -> and only then outputting it
 
$content is used to get the usernames in the preg_match_all()
 
yes that is not output
 
ta-da
 
...
Again escape when outputting, not in a random other place
 
Are you trying to be helpful?
 
6:26 PM
Yes
Are you trying to be sarcastic?
 
....actually, enough internet for one day.
 
How, by saying things as wrong?
 
@Danack Speaking of having enough of internet. You up for a round of league next week? :)
Depending on how it goes I am either the best or worst support you have ever seen :D
 
7:31 PM
@Danack I like your guide to how internals thinks
 
@Andrea Thanks. Have you ever read Larry Niven's ringworld/kzin war books?
 
@Danack alas no, I am so unlearned culturally :p
 
s/animals/dumb people/
That's the title I'm going to start using.
@PeeHaa yes, though I mostly play Aram, as learning pathing is too hard.
 
Cool. I suck at aram but it will be fun :D cc @Ekin
 
could I maybe join?
 
7:36 PM
@Tiffany league?
 
aram specifically
 
I'm on EU west btw - can you connect to that?
 
Sure. The more people suck besides me the better :D
 
I think so... I'll check when my head is less hurty
 
\o/ am in, let me know when
 
7:46 PM
Back to curling up into a ball of death
 
8:16 PM
@beberlei do you have a link to where that terrible suggestion was made about context dependent behaviour please? apparently I need to include exactly what was being suggested.
 
8:34 PM
“trained to deal with other species without reflexively killing them”

amazing
 
8:48 PM
Room 11 League, when I'm not near my desktop computer >:(
@MátéKocsis saw the ping, currently doing Complex Analysis Coursework, the examples look good but what is going on with the normal %f print modifier? From what i vaguely read Derick told to keep the locale aware bit, maybe that should be added to the non affected behaviour?
 
9:16 PM
Could I get help closing this question? stackoverflow.com/questions/15868935/…
I can't figure out what the OP is asking about.
 
@Dharman It has several answers though and even accepted one
 
What is the solution and what was the problem?
 
The answers are pretty garbage though :D
@Dharman halp. cod no worky?
:P
voted
 
Thanks. :)
 
@Girgias only in planning stages as far as I know. If you joined, it'd be five
 
9:28 PM
@Tiffany my desktop is currently over 1000km away from me as I'm back in France :-/
 
:(
 
9:45 PM
Hello guys, would any of you mind helping me out? stackoverflow.com/questions/60793621/…
 
@PatrickKusebauch Your question is kinda broad
Do you understand oauth and the use of the accesstoken?
 
Yeah, as I said I have it set up and working, but right now I store it as a blob, just looking for a way to structure the AccessToken data.
 
You are not storing it as a random blob though
You are storing it as json
json is structured
By definition
 
Yeah, ok, maybe not the proper term, let's say predefined structure
 
Why do you want to store it differently?
The answer to that somewhat defines how to store it
 
9:50 PM
On, one reason is to check whether the token is expired or not even before recontructing the whole AccessToken object.
The second would be to automatically refresh tokens close to expiring via some background task.
where applicable of course.
 
So have a proper typed expiration field :)
 
yeah obviously. That is kind of the question. What are all the fields and their naive types
 
depends on your database engine
 
@Girgias Good luck with the coursework! Yeah, that's a good idea to add "%.2f" to the non-affected behaviour!
 
Thanks :D
 
9:54 PM
Yeah, pseudotypes would be good enough.
 
Well check the class I linked to see what native php types it uses
 
So:
access_token - string (sequired)
resource_owner_id - string
refreshToken - string
expires_in - some point in time (fallback to expires)

Those are standard.
Anything else is just a bonus data...

Would that be a fair assessment? @PeeHaa
 
Those without the resource owner are pretty much the standard oath fields yeah
 
OK, thanks.
 
np
 
10:17 PM
@CraigFrancis I'll have a look tomorrow or so. But, feel free to ping me if I forget (likely to happen)
 
@Derick, thanks
 
10:39 PM
@MarkR just saw your karma message now, i don't have that info now, but could be done. not sure its productive though, at least i don't want to step into that terrain :D
@Danack somewhere in the replies to my attributes tweet, twitter.com/beberlei/status/1237027773958496258
 
@beberlei Okie dokie. I'll scrape it myself if I decide to take a look. I was just wondering what the results would look like if only people with php-src karma voted.
(Just curiosity if people who you would typically expect to have a greater understanding of internals vote in roughly the same proportion as the wider group for/against... because science)
 
 
1 hour later…

« first day (3444 days earlier)      last day (1488 days later) »