« first day (3446 days earlier)      last day (1485 days later) » 
01:00 - 18:0018:00 - 23:00

1:37 AM
@NikiC I don't think I've ever heard you comment on my idea for enhanced array destructuring as a way of addressing the named parameters space. What do you think? Most recently described it here.
 
 
1 hour later…
3:02 AM
@MátéKocsis made some tweaks, but done half asleep so who knows if they are good
 
 
3 hours later…
5:34 AM
Morning
o/
 
 
3 hours later…
8:07 AM
\o
 
8:17 AM
hello guys
how are you
 
8:39 AM
 
/// Example
$country_two // variable after two database value
$exclude // 1/0 value , check 1 work default function

$country // targeting
$state
$city
$connetction
$carriars


if($country == 'All')
{
if($state == 'All')
{

}else if($state == $state_two){

}else{
echo "Defolt page";
}
}else if($country == $country_two){
if($exclude){
if($country !== $country_two){

}else{
echo "Defolt page";
}
}else{
if($state == 'All')
{

}else if($state == $state_two){
}else{
echo "Defolt page";
}
}
}else{
Hi friend i have multiple variable i want to create simple and sort function please help
 
 
1 hour later…
10:04 AM
moin
 
Madainn mhath!
 
o/
 
@Girgias It was okay (I only found a really small typo)! Do you feel like announcing it? :)
 
Sure could do
 
Lim
So I encountered a problem where the code ignored the 0 at the end of the value

As the value is C-0010
but when it is saved it turned to C-0001
my php is connected to MySQL database and I encountered this bug
for normal values is alright but when it comes to the ones with 0 at the end it will be ignored
 
10:48 AM
Hey, if anyone is able to help with a quick question, that would be amazing. We used to cast \DateTime() to an array in 7.3, but it's not working in 7.4. (I think because of this: "Calling var_dump() or similar on a DateTime or DateTimeImmutable instance will no longer leave behind accessible properties on the object. " - any advice to getting it working again - is there a toArray function or anything? Only thing that works is if we json encode, then decoding again (but feels messy). Thanks
 
@EddTurtle Why do you need it in array format?
Can't you just use ISO format instead?
In related news it works for me regardless? 3v4l.org/1Tpcj
 
@PeeHaa it's part of our logging, feels nice to have date time and timezone together
@Pee
 
@EddTurtle ISO supports TZ information
@EddTurtle @Edd
:P
 
@PeeHaa it shows in ... hmmm, ye scrap that, a change of how we store it might be the answer
@PeeHaa thanks for your help
 
If you really have a case where casting fails it would be a bug so I you can repro :)
 
11:06 AM
@PeeHaa We're passing this to the mongo library, which I'm guessing might use get object vars (or something similar). This is an example of the change: 3v4l.org/Qbp0I
 
You said you were casting to array :P
 
Yep, sorry - I got it working now, thanks for your help
 
\o/
 
11:24 AM
Why does php/phpunit compain here: return ['model' => end(explode("\\", $this->wrapInModel)), 'entry' => $object];
PHP Notice: Only variables should be passed by reference in
is it the end? phpstorm highlight the first parameter of end like &$array for autocompletion
 
end works on a reference as it changes the internal pointer
 
so i have to explode the var in the line before and then pass a variable to end? :X
 
That is one way yes
You might want to use basename instead judging by your code
?
 
explode should be the fastest
i think basename is slower because of windows/unix path conversion
 
fastest? :P
How many times do you do that? :P
 
11:30 AM
could be atleast 5 times per request!!!!11
:D
 
Just pick the most readable one and don't get stuck on micro optimizations
 
I am on your side. I remember the first version was basename but due to a other bug i changed it.
and then i did not change it back
but why is it a notice in the first place? What is the "anonymous return type" when not a "variable"
 
Because it is not assigned to anything
 
@user3655829 It's a bit of grey area
The main purpose of end() is to move the internal array pointer. If you don't pass a variable to it, it will have no effect
In this case, end() also has a second function (returning the last element) that works even without a reference
Unfortunately we only have array_key_last(), there is no simple "proper" way to get the last value
 
11:51 AM
@EddTurtle var_dump((array) $d);
 
12:17 PM
@NikiC thanks
 
12:30 PM
anybody knows how to connect php with google clode datastore using Google Cloud Client Library .
 
> Don't ask to ask, just ask.
 
Let's bundle everything in core because my shitty host doesn't include the extensions I want :|
 
@pmmaga YOLO
 
YOCO - You Only Compile Once
 
JOT - Just Out-of Time
 
12:39 PM
Just move the ext into the userspace with php only :X
 
need urgenent help for my issue
 
lol
 
I'm glad to see someone else wants mysqli to be more like PDO on binds
 
I also need urgent help for my issue.
My issue is that I can't be arsed with today and I want to go to bed.
Help?
 
They make pills for that. I'd suggest liquor, but you'd be breaking quarantine
 
12:50 PM
@DaveRandom Get yourself really into a video game
 
I'm not quarantined from getting drunk
@Machavity the mysqli bind API has always felt to me like it was designed to be deliberately obtuse
@Jimbo a lot of openra and openttd is fast approaching
 
@DaveRandom I've used it enough to see where whomever designed it was going. But it only "just works". It wasn't designed for how people actually code
 
It wasn't designed.
 
@DaveRandom Never heard of openttd before, looks like fun
 
Well, yeah. PHP does mean Programmers Hating Programmers after all. If it's user friendly, we're breaking design :P
 
12:57 PM
@Jimbo mate, seriously, it is a time vacuum like no other
 
@Jimbo suggestions?
How does my migraine skip a day? My head hurt Saturday, it skipped Sunday, and now it's back -_- how does this happen
Maybe need more water?
 
@Tiffany Open world ones help, Skyrim, RDR2.. even good old WoW
 
Open world games bore me, believe it or not
I guess I'll stick with PoE
 
Power over Ethernet?
 
1:14 PM
Player over Environment?
 
Perl object environment?
or maybe just reading Edgar Allen Poe?
 
Portfolio of Evidence?
 
PHP Objectified Emacs?
 
Peace on Earth?
 
1:19 PM
@DaveRandom Just go to bed :-)
 
I'd love to, but I'm too busy shouting at various computers
it's almost like they don't fear me
but I know that can't be true
 
Path of Exile
 
ugh I am an idiot.
3 hours I have just spent debugging DNS queries disappearing into the aether, turns out I had configured a DNS server to relay requests to itself.
 
1:38 PM
Goob jorb
 
So you were in a BIND?
 
badum tish
 
Can anyone help?

When I run a simple select query on my local machine it takes 0.0035s to execute it, on the GCP SQL it takes 0.12s(I run it over their terminal). That's a 188% difference!?

Also I run it on a good machine, db-n1-standard-8 type which is stonger than my local machine.
 
1:56 PM
missing index?
 
Add EXPLAIN to the query
 
Hey! I want to replace the words which are starting with an @ symbol with a link (basically i get the id of that user and write it to an a href /account/pages/?id=$id ) Thanks to @CraigFrancis i got it semi-working.
But it only changes the second occurence so Im back here
Current code: <?php
include '../db.php';


$content = 'Hello my name is @kahveciderin i love @php';

$html_content = htmlentities($content);

preg_match_all('/@(\S+)/', $content, $matches, PREG_SET_ORDER);

$usernames = array_column($matches, 1);

if (count($usernames) > 0) {

$in_sql = implode(',', array_fill(0, count($usernames), '?'));

$sql = 'SELECT id, username FROM users WHERE username IN (' . $in_sql . ')';

$statement = mysqli_prepare($db, $sql);

$params = [str_repeat('s', count($usernames))];
pls help lol
 
Please don't dump an entire page of code, but rather use github gists or something alike
 
There is a see full text button so i dont think i must it couldve been better if i did
But i dont think i must
 
No idea what you are trying to say... thanks for taking it into consideration
 
2:05 PM
Hi guys, I'm using Php storm on a windows machine for the first time, i'm used to used oh my zsh as a terminal, what is most commonly used in windows and what would you say is best to use?
 
@Derick @Machavity thanks for the hints
 
@kahveciderin GitHub gists allow you to properly format your code and if set up correctly, includes syntax highlighting. It's rather nice.
 
@KerrialBeckettNewham just use cmd. Use the things that are native to your current OS, otherwise you will end up getting lost in some weird x-platform issue
that said, install git for windows with the "use everything from everywhere" path option so you get tools like touch and grep etc on cmd
 
so you don't use autocomplete in any OS because it's not native?
 
Morning
 
2:18 PM
Thanks :) yeah I installed git for windows
 
I prefer a mix. PHPStorm has its own git implementation, but I also use git for Windows and TortoiseGit
 
@KerrialBeckettNewham how do you mean sorry?
git bash and the like a very square-peg-round-hole
(imho)
 
@DaveRandom doesn't matter, you answered my question, thanks :)
 
but cmd is a horrible little pack of weirdness
 
@DaveRandom that's the feeling I got
 
2:21 PM
@KerrialBeckettNewham if you are feeling nihilistic, read this
it does a lot of stuff which is very clever, but not useful, nor has it ever been useful
I mean some of it might have made sense on 14400 baud serial terminal. maybe
but I don't think windows has ever really been used like that, not even pre Windows-3
oh and its bit endianness is wrong, but that's not a problem you are ever likely to run into
at the same time though I <3 Windows :-P
 
Thanks so much for the info. I've been a mac user for a while, so never really needed to use windows. Both have their pros and cons.
 
not even sure that's true, I'd more say that they are just differently shit
 
@KerrialBeckettNewham Apple secretly replaced MacOS with a nicer FreeBSD GUI. have you noticed? :P
 
cmb
2:52 PM
@DaveRandom interesting article. Fortunately, escapeshellarg() and escapeshellcmd() do it right. :p
 
no they don't :-P
 
cmb
I wonder what these functions are good for (on Win)
 
well it's complicated, it's not obvious from the manual what the actual purpose of each is imo
(escapeshellarg is use for building a command line, escapeshellcmd is for escaping a full command so it can be run in a shell without leaking stuff through pipes etc)
 
cmb
yeah, but they may just cripple the input
 
yeh
function escapeshellarg_win32(string $arg): string
{
    return '"' . \preg_replace_callback('(\\\\*("|$))', function (array $m): string {
        return \str_repeat('\\', \strlen($m[0])) . $m[0];
    }, $arg) . '"';
}
That's good enough, most of the time
it quotes everything regardless of whether it needs quoting, but it doesn't eat your data
 
cmb
2:57 PM
and, of course, there's a huge difference regarding bypass_shell
 
What monster uses parens for regex patterns
 
don't knock it til you've tried it
 
No :P
knock all the things
 
In other words "Yo dawg, I saw you using the CLI, so I put quotes in your quotes so you can get crazy long unreadable error messages"
 
cmb
@DaveRandom but only for proc_open with bypass_shell; for all other cases, this does not work as intended
 
3:02 PM
@cmb yes and no. It's only part of what's required, is a more accurate
imho, always bypass_shell though
if you want to pipe output and stuff, do it with PROCESS_START_INFO
 
cmb
@DaveRandom ACK (unfortunately, that renders all other proc exec functions useless on Windows)
ah, and as of PHP 7.4.0, don't escape yourself, but pass an array of args to proc_open()
 
indeed, I don't generally use them. I wish I had a more rosy/helpful thing to say about it, but the long of the short of it is that escaping shell commands is complicated and you need to know what you want in order to get the right thing out the other side
 
cmb
ACK
 
SYN?
 
RST
I'd like to tell you a UDP joke, but you might not get it
(classic)
 
3:07 PM
Im trying to get XDebug running on WSL2. I see PHPStorm sends this command: `[wsl://UBUNTU1804]:/usr/local/bin/php -dxdebug.remote_enable=1 -dxdebug.remote_mode=req -dxdebug.remote_port=9009 -dxdebug.remote_host=127.0.0.1`
How do I have phpstorm set a different IP instead of 127.0.0.1 ?
 
well that's passing explicit php.ini options on the command line, so look for config pertaining to that
 
Found it! Had to overwrite it from Interpreter options.
 
3:26 PM
I hate you @JoeWatkins github.com/php/php-src/commit/…
 
interrupting my plying piano to tel me this feels unreasonable ...
 
:P
 
@Machavity @Derick I have followed your hint and I was able to index my tables.
Local machine is now very very fast, but the cloud sql is a bit faster.
 
lol
 
3:36 PM
@Machavity That was me, wrote an abstraction for mysqli bind years ago, tried writing an example in vanilla PHP, and remembered how painful it was... but PDO doesn't accept variable types, so do they all get switched to 's'?
 
@CraigFrancis I'm not terribly familiar with PDO, but I do think they have different data types. The big gotcha with PDO is it will do escaping by default if you don't tell it to prepare
 
PDO has many gotchas.
 
@Machavity what?
 
Yep, PDO has explicit bind types php.net/manual/en/pdo.constants.php
 
@Machavity *for mysql
 
3:42 PM
@PeeHaa I thought he was comparing PDO binds to mysqli
 
Still don't get it
 
tbh it generally doesn't make much sense to say "PDO has x or y" because it's different per driver and depends on options
 
@Machavity Do you mean emulated prepares?
 
well everything is inherently a string there
 
@PeeHaa Yes. I believe PDO does emulation by default (unless something changed)
 
3:45 PM
Of course I could read the manual:

http://www.php.net/manual/en/pdostatement.execute.php
"All values are treated as PDO::PARAM_STR"
 
Ah yes for mysql
@Machavity That's solved by using postgres :D
 
@PeeHaa :P
 
@Machavity *for mysql
:-P
 
Anyone know what the advantage of using the different types (i, d, s, and b), considering MySQL already converts id = "123" to an integer... interestingly the manual does say b (blob) is sent in packets (I assume that means separate packets).
 
use a proper rdbms
@CraigFrancis it depends whether you are doing actual parameterisation or not
 
3:49 PM
@DaveRandom maybe we should use a proper programming language :-P
 
PHP can be a proper programming language if you know how to use it properly
 
@CraigFrancis IIRC mysqli will cast for int and float types. Not 100% on that
 
@CraigFrancis e.g. limit must be an int
 
I'm using mysqli_stmt_bind_param, so yes.
 
@Machavity what it dictates is where any casting is done (PHP or DB), more than anything else
if you are sending parameter values, it describes the manner in which they are transmitted across the network
 
3:51 PM
@DaveRandom <?php exec('java application.jar');
 
if you are doing emulated prepares, they behave more like printf() format codes
 
@PeeHaa didn't know about LIMIT (have been doing that for years, just never tried anything else)
 
@PeeHaa ©Oracle 2020. All rights reserved. Violators will be sued into the ground
 
like if you bind an int it will be (for mysql) transmitted as a 32-bit int across the network, i.e. the data will always take up 4 bytes
 
@DaveRandom Ah, that makes sense
 
3:52 PM
pdo is not a great abstraction if you care about that stuff tbh
or arguably in general, though I don't hate it
 
@DaveRandom Interesting, so probably won't make much of a difference for most people, but might save some bytes on the network.
I quite like PDO for being able to do a parameterised query in 2 function calls... mysqli can only dream of that.
 
well yes, and it can alleviate some interpretative ambiguities at the other end, not so much with an int but with d you get an unambiguous IEEE754 binary representation sent over the network, if you bind s then you may get some string representation that is subject to regional variatio, for example
 
mysqli is a tool for working mysql compatible DBs. PDO is a Swiss Army knife for working with almost any kind of DB. PDO does some things far better than mysqli, but not everything
 
@Machavity yes and no... PDO is a lowest-common-denominator feature set
it has a better API design than mysqli in some ways, but feature wise it's not super awesome
 
The problem is mysqli lacks some of the creature comforts of PDO or even the less secure string inserted query. As such some people prefer regression to prepared
 
3:58 PM
it's solving a problem that no-one really ever has, trying to be a common API allowing you to do drop-in replacements of a back end, but that's not a thing anyone ever does, not does it even work since you then run into sql dialect differences and stuff
 
@DaveRandom That's a good way to put it
 
@Machavity yeh I get that, not defending mysqli which is also hateful
 
Thanks for the background.
 
but it is nevertheless a much thinner wrapper, making it more capable of doing what you want, but also a lot easier to shoot yourself/others in the foot/back
 
My favourite in mysqi is $sql .= 'id = ' . mysql_real_escape_string($_GET['id']);
 
4:00 PM
Compared to PHP 7.4 (now with 50% less ways to blow your foot off vs PHP 4.0)
 
obv, don't do this, it's really bad :-P
@Machavity fair :-)
 
@CraigFrancis Funny thing is you could cast that to (int) and make it secure, as long as you recognize the potential gotcha
 
> all strings cast to 0 by default
That's not entirely correct @Machavity
var_dump((int) '2lolsqlinjection');
 
user image
3
 
@Machavity Good point, personally I would still prefer parameterised queries where the SQL is only made up of literals, but I think everyones had enough from me on that :-P
 
4:07 PM
@Danack One of the first jobs I had was written in ColdFusion running SQL Server. Had a customer want to run it off Apache/MySQL. Making all the queries work for both was a pain
@PeeHaa So if it starts with a number it just truncates it off?
 
It's PHP being h̶̛̰͍͇̟̩͍͉̼͇̗̻͙͚̆̀̀̀̽̄͂͌͑̆͜ê̷̛̖̣͍̣̹͈̰͚̖͐͒̀̾͒̍̽̾́̿͜l̸̻̼̮͖̙̥̳̇̆͋̃̅͌́p̴̢̖̻̙̤̓͋̈́̽͂͑́̑f̸̛͙͉͉̥̝̬̣͑̓̂̆̄̈̿͂̐̔̇̆̚͜͜͠u̵̧͉̫̻̗͚̳̲̟̇͌̉̅͋̌́͂̀̈̏̎͘̕͠ľ̶̨̩̘̫̬̭̦̠̚
 
I assume when you say LIMIT must be an int, you mean it can't be `LIMIT "1"`, as the following works (and it needs a variable, because, reasons)...

$s = $db->prepare('SELECT * FROM user LIMIT ?');
$s->bind_param('s', $limit);
$s->execute();
 
hmm interesting. I remember pdo breaking on that exact thing
 
maybe it's doing the fake parameterised queries?
 
4:13 PM
neh I never run with emulated prepares
Although only god knows what PDO does exactly
 
If I have a massive array (50 lines of code) in a loop that has about 250+ iterations, would setting the data to an object have any performance improvements? So instead of looking up array indexes (varying levels) it'd be a getter call?
This is very generalised question so just looking for theory/possibly/probably not answers
 
Impossible to say because the info is too generalized
Unless "it depends" is a valid answer
 
@James wait until someone complains about something being slow before optimising. But also.....I'd strongly recommend not using arrays that are complicated....
 
Danack I'm stuck with some legacy code. Refactored a bit but object would be a fair bit of work so wondering if worth it
and I guess not just about speed really, might make the code cleaner with an object (am a bit meh on that atm)
 
Today the emulated one seems to have a problem, otherwise it seems fine.

$pdo = new PDO($dsn, $user, $pass, [PDO::ATTR_EMULATE_PREPARES => false]);

$statement = $pdo->prepare('SELECT * FROM user LIMIT ?');
$statement->execute([1]);
 
4:17 PM
\o/
Can't complain when things work correctly :)
 
@PeeHaa Yep, 'tis good to see
 
@PeeHaa I bet I can
 
cmb
@CraigFrancis you need $statement->bindValue(1, 1, PDO::PARAM_INT);
 
@cmb Good to know, normally I'm using mysqli (although indirectly), so all of this nice and easy PDO stuff is foreign to me :-P
 
@DaveRandom Speaking of things working correctly. You saw my ping of php not working correctly on <=7.4 with sockets :)
I went through all that trouble and you deleted it @Machavity :(
 
4:32 PM
I thought it was good.
 
Thank you
 
@PeeHaa no?
 
Let me find it
 
no.
 
yes
2 days ago, by cmb
@PeeHaa works with current PHP 7.4.5-dev on Windows as well
\o/
 
4:34 PM
 
The localhost thingy on ipv6
@Machavity I... like odbc :P
 
@CraigFrancis That moment when you suddenly realize there was a better punchline
 
oh right, so is that because something is fixed in tree but not in releases or just cussidness?
 
ye
Probablly
Something
:P
It does blow up libdns though :D
 
@PeeHaa ODBC isn't bad. ODBC without PDO in PHP is... uhm...
 
4:35 PM
> PHP Fatal error: Uncaught TypeError: strlen() expects parameter 1 to be string, null given in /home/ekinhbayar/PhpstormProjects/async-dns-server/vendor/daverandom/libdns/src/Encoder/Encoder.php:161
Stack trace:
#0 /home/ekinhbayar/PhpstormProjects/async-dns-server/vendor/daverandom/libdns/src/Encoder/Encoder.php(297): LibDNS\Encoder\Encoder->encodeDomainName()
#1 /home/ekinhbayar/PhpstormProjects/async-dns-server/vendor/daverandom/libdns/src/Encoder/Encoder.php(342): LibDNS\Encoder\Encoder->encodeResourceRecord()
But will test it more once I have it working on my machine
 
@PeeHaa a lot of things do :-/
 
:-)
 
I aim to have v3 tagged by end of Apr
 
It also involves amp though :(
 
which a) has fixed a lot of things and b) will be a lot easier to debug
 
4:37 PM
c) has a much saner API
 
well yes, b) is a result of c)
I will update amp/dns once v3 is tagged
 
awesome <3
 
well, we will ;-)
:-P
 
oh nice :P
 
@CraigFrancis The original if you still want it
 
4:39 PM
thanks
 
cmb
@DaveRandom yep, recent bugfix (also in PHP-7.3 btw)
 
@cmb #lazyweb link to commit/issue/whatever? I never got as far as actually investigating it, I was assuming it was a wrong bind with flags or possibly a weird inetaddr representation
 
cmb
@DaveRandom bugs.php.net/bug.php?id=78210 (see commit message for details; might just have been item 3)
 
As to the mysqli needing a "method to bind a single parameter"... I think I agree, but I'm not sure how well it would work with needing to know the parameter identifier when they are numbers (as the example uses)... I often built up SQL statements that are based on certain search form fields being filled out, so that might be tricky.
 
@cmb nice one ty
@cmb ahh yeh, makes sense, kind of what I was thinking when I said "weird inetaddr representation"
 
4:53 PM
@CraigFrancis The way I see people dynamically build them is you have an if block where you're adding something to the query. I would do my bind there since we're already in the if
 
@Machavity Still would need to know the number, where previous ones might not exist, so I'd probably need to use a variable doing $i++ to keep track.
 
Maybe. But a bind-as-you-go methodology is how people procedurally do it now. If we reduce that barrier to entry, it might leave people to use it
 
Oh, I'm in complete agreement, I want to make it much easier to use... not wanting to sound critical of it's current implementation, but I'd rather it be easier for people to get it right by default.
 
Well, I'm fine with an array at the end as well. And PDO supports both
 
Just for reference, as to why it raised it's ugly head again is because I was wondering (yet again), if there was a better way... my version (not necessarily better) is at news-web.php.net/php.internals/109202
 
5:09 PM
@CraigFrancis Yeah, I think we're on the same page. I wrote up a gist similar to that (externals doesn't have markdown) gist.github.com/machavity/c84dad59bbc4d7d37b2d6e6bfd654df3
I actually installed VS2019 and downloaded php-src, but trying to untangle what the C code is doing proved difficult
 
If we're going to have an is_literal function I think we need an is_figurative function too
 
@Machavity The optional $position is a nice touch... does it get reset after the query is sent, as you might want to re-use the statement (e.g. issuing multiple INSERTs)
is_figurative?
 
It could. I hadn't thought about that angle. is a good point
 
@MarkR I'd like to get the is_literal (or, as Jakob suggested, is_from_literal), but I have no idea what the next steps are... I'm not a C programmer in any way, and I'm sure I would end up creating considerably more security holes if I tried :-P
 
Interned strings in PHP have a flag saying they're interned, which usually means they're taken directly from the source code somewhere... but while basic string copies will handle that, most dont
So while it would be possible to just expose ZSTR_IS_INTERNED() its reliability would be extremely limited
 
5:18 PM
@MarkR don't forget is_metaphore()
 
Interesting, that would be really useful... do you know what it's used for? ... and would it cause performance issues if it was used for this purpose, where something like $a = 'b' . 'c'; still be considered "interned"
 
youtube.com/watch?v=4-ImRMJX68s my favourite bit about literally
It's used because they can't be freed.
 
ohh, that's a good point
so it can't be used directly, otherwise $a, in previous example, would never be freed.
 
In your example it would never get that far. Opcache would convert it into 'bc' before it ever ran... but I'm not sure if it would set the flag or not
 
It's been mentioned that the String variable structure has flags on it, but I think Derick mentioned there being a limit... so would there be any chance of adding a 1 bit flag, that gets set to 1 when the variable is being made up of interned strings?
 
5:23 PM
I'm not seeing why/when this would be useful in userland, tbh
or even in the engine
 
Short answer... a variable made up of values from the PHP script cannot be vulnerable to injection attacks (SQL, Command, and some versions of HTML)
 
Facebook originally did something similar using static analysis if I remember right, they require their query builder only accepts values marked as literal or wrapped in an unsafe()
 
doesn't it make more sense to check for constants?
which must be possible somehow
 
Ohh, thay did, that's interesting... I suppose I want that, but at run time (I have a couple of issues with static analysis, the main one being that I forget about it after a while).
Maybe... but these strings often get appended to (e.g. $command = 'grep ? /path/to/file'; $command .= ' | wc -l', just to show a Command line version)
 
@CraigFrancis it just feels like an awful lot of work to do at every assignment
rather than having things look for their definition when requesting a "literal value", I mean
tbh this whole thing feel a little magic-quotes-y to me
 
5:30 PM
@DaveRandom Maybe, but I don't know if there are alternatives, I'm open to suggestions... one I've wondered about is with the compiler (but I know even less about those).
 
i.e. like the sort of thing that would be easy to shoot yourself in the foot with
 
Oh, it's the complete opposite of magic quotes :-)
 
@CraigFrancis no I get that, I mean more in the context of what it's doing, it doesn't feel like something that belongs at the language level
I could be wrong, I will apply more brain cells at some point
 
Rather than having something that tries to fix things, tries to understand what you are doing, this is a way to absolutely, without question, prove that the variable contains a literal (no user supplied values).
 
Just started using Joomla. Following error. Not an issue in 7.3 ・ Unknown/Other Function ・ #79406
 
5:33 PM
oop sorry @Kalle! :-)
 
@PeeHaa ah doesn't matter, its most likely a hidden error due to error_reporting in Joomla itself
but such should be reported to the Joomla project, not us
 
Will nuke it
 
We should partner with one of those custom clothing manufacturers for 8.0

"I used error_reporting=0 and all I got was these damned exceptions"
 
Make it happen
 
Anyway, thanks @MarkR, I've added a note about interned strings to the RFC, it might be useful in trying to find a way to make this work without there being a performance hit.
 
5:47 PM
Your problem isn't going to be dealing with individual strings, that's a simple flag change if behaviour is what I think it is. The problem will be anything which touches them.
That taint extension seems to override a lot of standard library functions
 
It does, but it's also having to accept the un-tainting part (which I really don't want)
If you have the time, can you explain the problem with the things that touches the strings?
 
cmb
@AsyncBot \o/
 
@CraigFrancis If you do say, sprintf using a set of arguments which are all interned strings, you could assume the output was also not possible to interact with by user data, except the function itself provides no such guarantees.
 
@CraigFrancis and exactly how much of the problem space does that cover? and is it the important bits?
 
I'd probably say that anything from sprintf is not a literal, so the returned value will set the flag to false... I'd say the output from almost all functions will be treated like that... the only exception I'd really found is trying to do the WHERE x IN (?,?,?)... as I need to use something to make the variable number of "?", something I've done with implode(',', array_fill(0, count($ids), '?'))
or substr(str_repeat('?,', count($ids)), 0, -1) ... where i've been trying to find a way to do it in less function calls, but no luck so far :-)
 
01:00 - 18:0018:00 - 23:00

« first day (3446 days earlier)      last day (1485 days later) »