« first day (3446 days earlier)      last day (1484 days later) » 
01:00 - 18:0018:00 - 23:00

6:08 PM
implode(',', array_fill(0, count($ids), '?')) something like that?
 
Yep, that works... so both arguments for implode(), and the first argument for array_fill(), if they are from literals, then those functions would return something considered to be a literal... I can't think of anything else that would be useful (and yes, it does annoy me that I even need these exceptions).
@Danack Have I answered your question about the problem space (I assumed it related to the other functions).
 
6:25 PM
@CraigFrancis not really... I meant more in the general sense that people still need to use data from various sources in a careful way. How much does tracking literals actually help guard against all of the different escaping needed? I don't actually know the answer to that, but it seems even for stuff that does come from a literal.....I still need to escape it correctly for the different types of escaping.
$foo = 'Hello there <b>some html</b>';

echo "<h1>". $foo . "</h1>";
I can see $foo comes from a literal. That doesn't help me decided to know whether it's correct to show it unescaped or not.
If it's for a page showing how to write HTML and demonstrating a bold link - it shouldn't be escaped. If it's meant to be bold then it does need to be escaped.
 
@Danack Good question... now I think SQL injection is an easy one to see, because the framework/abstraction of choice can easily check it will send a literal to the database.
... now you raise a good point about HTML, as you're sending it to general output... now I would start by looking at a templating system (many frameworks come with one), these would really benefit from knowing the HTML string they get is a literal, so the user supplied values must be provided separately.
generally speaking, because HTML is a bit complicated, you kind of need to create a DOM, so the values that get merged in, are done so in a safe way (hence the need for it to use a templating engine of some kind).
 
The thing is that even literal values needs to be escaped
 
For example?
 
@CraigFrancis Thanks - I prefer to use: github.com/Danack/esprintf
 
Be it in sql or html or wherever
 
6:33 PM
Is wiki.php.net down?
Or just my internet playing games
 
@CraigFrancis Dan's example. Or inserting $val = 'I am a literal\''; into the db
I see the usefulness as a tool, but it will never prevent having to escape data for contexts
 
@Danack Perfect... so where they have created esprintf(), that first argument would do really well to be an enforced literal.
 
@CraigFrancis No. There would be use-cases where I want a site admin to be able to edit that.
and so it could come from a DB.
 
@PeeHaa The escaping for context is important, this check allows the system that's doing the escaping to know it's working with something that's safe
 
I see that, but what I am saying is that regardless of perceived safety you have to escape anyway
Again I see the usefulness as a tool, but I do not see it as something that will prevent users from having to manually escape data
 
6:39 PM
@Danack That's like the phpMyAdmin case, where they wouldn't run this check, but they could do something like saying, it must be a literal, or it must come from htmlpurifier (perhaps an object)... I'm not sure if you've seen the JavaScript Trusted Types thing, but that's what they are moving towards.
 
Last thing I am going to utter before doing food
literal !==safe
 
@PeeHaa It kind of is... because you know it's not from outside the PHP script
 
That doesn't mean it is safe
 
This is pretty similar to a theological discussion... God of the gaps
 
Example?
 
6:41 PM
I write my translations to a php file containing an array of data
 
@PeeHaa But you're right, there will need to be escaping, it's just about making sure it's done at the right time.
 
The translations are coming from a CMS
The translations are literals
 
Bit odd, but ok :-S
 
@PeeHaa THE TRANSLATIONS ARE COMING FROM INSIDE THE HOUSE.
 
:P
@CraigFrancis How is that odd?
 
6:42 PM
Well, I suppose it's not, I just don't see that being particularly common... I'd never allow my systems to write/execute code thats kind of from user supplied data.
 
It's not executing code
It's data
And it's just a simple example to illustrate the "problem"
 
Well, it's one example, like the phpMyAdmin one
But it doesen't stop having a tool for systems like WordPress to start identifying issues like SQL injection in an easy way.
 
The fix for sql injection is using prepared statements
 
Exactly
And this helps me know the prepared statements I write do not contain any mistakes
 
To be clear about chat.stackoverflow.com/transcript/message/48928408#48928408. For each problem with the solution we're pointing out, you're just replying, "oh that can be solved by this." But this is a infinitely deep problem. There will always be edge-cases that can't be solved by a solution.
 
6:46 PM
Howdy all, Got a html css question
 
bbiab food
 
Considering adding a range slider but having issues with display
 
Last week I found $users = R::find('user', 'id = ' . $_GET['id']);
 
what gives here?
Cant figure out why range slider is out of line from other form fields
nothing corrects it either
no margins, paddings or anything else
 
yo
 
6:49 PM
Not really my area, but have you considered a wrapper <div>, and using flexbox? the current version is relying very heavily on line-height
 
Thx Craig, Already have a wrapper. Not wanting any 3rd party libs
line height is a great clue tho
brb
 
Add a <div> around the 4 fields, add display: flex on it, and remove the display: inline-box from the child div's.
 
+1
will investigate, Thx
 
oh, and the 4 children will need flex: 1 1 auto
 
flex is foreign to me
Might abort range slider for now
due to pita to get to show value
 
6:54 PM
Same here, but it's very useful for a single row or column of items
 
etc
 
Yeah, it is a pain :-)
 
;)
I dont really mind the work. Just might not be today
Any comments on general UI?
UI/UX?
 
Flex froggy game
 
of prev discussed form
 
6:56 PM
I know even less about UI/UX... just keep things simple is all I know :-)
 
lol
Im just winging it
my personal site
 
The froggy game is good, done it a few times, still forget most of it :-P
 
morning
 
range slider killed for now
 
6:59 PM
@CraigFrancis same :/
 
Not defeated. Only spent 15mins on for now
will revisit at a later date
 
It looks like overloading operator is gonna be declined as a one of many where a developer put enough efforts to present almost or nearly functional implementation only to get a bunch of "No" votes
 
no display of value is main pita
 
That's sad
 
Thx Craig
 
7:00 PM
np, and good luck
 
+1
 
@brzuchal Is this a common thing?
I assume there is a good reason, or is it just because people don't see the value? so default to no?
 
@Tiffany "Please save this frog from being run over on the road by using position:relative to position him correctly across the road"
 
@CraigFrancis Hard to say, opinions vary. This time I'm not sure if I vote cause don't have any strong feelings for nor against.
 
@brzuchal I think I'm on the same page, I'm not sure this is something I'd use myself :-S
 
7:06 PM
But what is sad is that someone puts an effort to implement a feature described in RFC and processes discussion period for this RFC and ad the end gets huge FY
 
Yeah, I'm getting a similar feeling, and thats just after writing an RFC, so it must be many times worse to have written an implementation as well.
 
Some discussions recently were about gathering feedback
Server-Side Request and Response Objects also gonna FAIL
Write-once properties as well gonna FAIL
 
@brzuchal There's been a lot of discussion over the Request/Response objects, and would tidy up a lot of the "where do I get/return X"... so that's a shame.
 
@brzuchal if it was easier for us to remove stuff from the language, it'd be easier to add stuff that lacks being obviously the right thing.
 
I don't think anyone proposed that before but maybe we should choose candidates or call for candidates to some kind of representative committee build from people with experience in processing RFC which pass to mentor RFC authors and to guide them and help them with processing RFC discussion and advising to the authors
What do you think @Danack ?
We do choose RM why not RFC mentors?
For a period, dunno 1yr or 2yrs
 
7:18 PM
I'd appreciate an RFC mentor
 
@Danack Yes, probably you're right here. But it won't change untill we decide about language evolution, right?
@CraigFrancis It should be someone or a group of ones really willing to help being objective with some experience and successful RFC's processed in past
 
Move of interbase into PECL not properly indicated in the docs ・ InterBase related ・ #79407
 
@Danack so going further deciding now about those 3 RFC's future without knowing how to evolve makes completely no sense at all, cause votes could differ if for eg. there could be editions or other gradual migration path - I think
 
That's a good point, you could be close to having something that's really useful, but because it's not quite right, you get a load of No's, then the feeling of rejection.
 
@brzuchal that sounds like an approach likely to fail. Both because either the advice might be wrong, or just the person doesn't want to listen to that advice. Turning it round the other way, and maintaining a list of stuff that could be worked on, that has a good chance of passing, has a much higher chance of being useful.
cough named params wiki.php.net/rfc/named_params
 
7:32 PM
Is it common for people to get burnt out from doing all this work, it going nowhere, then leaving the PHP world?
 
@CraigFrancis yes, but not through the rejection so much, more through people being annoying on the mailing list.
Which reminds me, the guidance you're seeking is pretty much what the mailing list should be about, not people saying their own preferred syntax, or how we need to make it easier for shared hosting companies to remain competitive.
 
Json module does not compile ・ Compile Failure ・ #79408
 
Splitting running RFCs into a tech person and the person who responds on internals is something worth doing.
 
@Danack being annoying, how so? not suggesting I know how to make things better, but I feel that knowing the problems can help.
 
how many of those people are actual maintainers? Whatever the cause, the mailing list has ceased to be a place where internals people discuss much.
(and yes, I know pointing out the problem is easier than finding a solution here)
 
7:41 PM
Ok, so quite busy (says he probably being guilty of some of that chatter).
Personally I think identifying the problem is useful, and talking about it might push people in the right direction.
 
@Danack internals has mostly been replaced by R11 for hardcore internals discussion it seems
 
Someone linked to a github repo where actually useful discussions about generics appeared to be taking place. I'm pretty sure having a model where stuff being worked on is announced on internals, but then the actual work is done and discussed elsewhere is a better idea.
 
@MarkR I must admit, I found the discussion earlier on here was very useful, especially about the interned strings.
 
And that could also be a way of getting feedback on ideas before getting a complete implementation done.
 
7:46 PM
@Danack You might have a really good point, it's how a lot of the web standards work is done.
 
@CraigFrancis A half-hour debate on here usually accomplishes more than a day on the newsgroups because there's no need to be verbose because if someone isn't sure about what a person said they can get an answer in seconds, rather than posting a reply, waiting a day, getting a response etc
 
@MarkR Speed is very important, and often overlooked.
 
@brzuchal I clearly said from the beginning that I don't like the idea of operator overloading before there was any resemblance of an implementation
 
I can see there are still people on the ML trying to convince me that named arguments and ctor args promotion can replace object-initializer :/
 
Moreover, you can just write a new thread on internals gathering the opinion of the list before writing the RFC/implementation as a way to test the water
Doesn't mean it'll be more likely to pass
 
7:52 PM
@brzuchal that's not the issue for me....the problem is that the syntax needed for named params is going to be an overlap with the syntax for object-initializer. And as named params is the 'bigger' RFC, for me getting the syntax right for that, and then getting object-initializer to play nicely with it, is better than the other way round.
 
ssh2_sftp() _libssh2_channel_free: Assertion `session' failed ・ ssh2 ・ #79409
 
Gosh I can't even anymore about Mike on the ML, I think i'll really start blocking him and making his emails go to spam
 
@Danack Isn't it enough that named arguments use new ClassName({arg: $foo}) and OI new ClassName { arg = $foo } to distinct ?
 
8:14 PM
@Danack I'm not against ctor args promotion nor named arguments would only expect someone seeing a benefit from all of them with OI together and not blindly looking for an excuse to use first two instead of OI cause it's not gonna work IMO
 
Minor Service Outage ・ Issues, PRs, Dashboard, Projects has Partial Outage
 
@brzuchal As I just said on the list before seeing you here :-), yes, named params/ctor promotion does entirely replace a dedicated OI syntax, and does more to boot.
 
> So I am arguing for PHP-equality vs what we have now which is a two-level PHP caste system.
Lol what
I need some alcohol to forget that
 
I assume the two level caste system is people who write PHP... and people who write wordpress plugins
 
@Girgias He's going to be a time-suck that never actually violates list rules so can't be removed, but never goes away. I've seen such people many times before. I really don't know what to do about them that doesn't come off as being a jerk. (I'm certain someone has said that about me at some point in my career, as well.)
 
8:25 PM
Also: I might need some help merging a commit into git.php.net later on if someone would be willing. I've never done it before.
 
oh it's easy, you just fuck it up royally and then ping @NikiC and get him to fix it
 
@MarkR Have you signed the waiver in goat's blood and taken an insurance policy out?
 
@MarkR onto which branch?
Master?
 
Yup
 
My workflow is
 
8:26 PM
@Machavity Two goats
 
git rebase -i master
And fixup everything so it's only one commit :D
Make sure your master branch is up to date
then merge (which should be a fast forward)
And push to git.php.net
 
Honestly, contributing to PMA proved fairly easy. They had me tweak a few things on my PR and then they took it after I swore I had written it
 
Thank ya. I will give it a go once I've listened to BJ shut the country down
 
@Crell yeah which is kinda annoying ... I think just ignoring him is going to be better for my sanity
@MarkR I've managed to escape to a country already on lockdown :')
At least I've flead to a new remote island like thousands on people did Friday
i.e. Animal Crossing
 
leaving office for last time, this is how that is going ^ :-P
 
8:29 PM
The only winning approach I've ever had is to pull someone aside in person and say "dude, seriously, no one likes you and people run from any discussion you're in, stop it." He at least took it well.
 
I mean that's something which can work IRL, but I don't know how we're ever going to see him (at least me)
 
> dude, seriously, no one likes you
yeh sounds like a thing people will respond well to :-P
 
@Crell Well, you had him by the throat. That helps
 
@DaveRandom although also /cc @PeeHaa
 
Still can't punch people over TCP/IP
 
8:31 PM
@Girgias debating on buying it...
the problem I end up having with Animal Crossing is I'm addicted to it for like two weeks, then never touch it again
 
@Tiffany I feel I'm currently speed running it ... aready got 40k bells in the bank
 
o_O
 
I was a bit more diplomatic in person. Plus the person in question was German, so he was used to the direct approach. :-)
 
s/Animal Crossing/any game delivered purely digitally/
 
But it's quite different from the Wii version which the only other one I played
But enjoying it
 
8:33 PM
@Crell tbf I have met you, I struggle to visualise you being undiplomatic in any way, shape or form :-P
 
@Girgias I've played it on GC and 3DS...and mobile...
 
I played the mobile version for 2 weeks when it came out
Haven't openned it since lol
 
going to curl up into a ball in my bed again, hopefully this affliction leaves me at some point today
 
/me shuts down to relocate computer to house
maybe both
 
All issues have been resolved!
system() swallows last chunk if it is exactly 4095 bytes without newline ・ Program Execution ・ #79410
 
8:42 PM
@DaveRandom I... am not sure if I should be flattered or correct you. :-)
 
I'm really not sure I know enough about the operator overload to vote on it yet... but I am really triggered about code repetition in parsing it
 
@Crell Right ... I finally got around to writing him a STFU mail just now
I'm happy with being the jerk here
 
Chaotic good
 
I think you're one of the few that can get away with it. :-)
 
Genuine Q, is there a reason we're still using mailing lists vs something with a bit more control like a forum where we could enforce posting limits? I had assumed it was just a its-what-we've-always-used thing.
 
8:55 PM
@Crell good so we have strong different opinions. I think ctor args promotion + named args cannot replace fully OI as same C# developers gave added all of them into their language
 
How does ctor promotion work in other languages with inheritance?
 
@Girgias you too?
 
@Kalle indeed, hopefully Nikita's email will do the job
 
@Girgias Sometimes I give up reading the thread if he takes apart of it, its just pollution :/
 
I feel you
 
9:05 PM
who's this then?
 
Sir Spamallot.
 
The replies are so long, and there are 3 in a row <:(
 
Hence why I don't want him responding to my analysis thread...
 
wow... 3 week lockdown for UK.
 
I would be surprised if it stays at 3 weeks
 
9:06 PM
don't see that mail Mark
@MarkR 3 months, easy
 
It's utterly depressing it had to be forced, because, apparently, a sizeable proportion of the population are thick as shit.
 
And the tube will look like this tomorrow again: bbc.co.uk/news/uk-england-london-52003076
 
I recon the army will get deployed to London
 
I wish every nation would go on a 3 week lockdown; let the virus run its course, then go back to work but limit international travel until we confirm all nations that have or have not done the same.
 
it'll just flare up in autumn again
there is no win here
 
9:10 PM
Yeah- we're going to have to do something until the vaccine is here in 18 months~
 
Like the PM said, it's just buying time to increase capacity before the worst hits
 
Tough times...
 
@Girgias don't get me wrong, I welcome good and well thought out responses, but when you read a few lines and you realize he is going in circles or have no idea about what he is talking about, then it just registers as spam to me
 
If there was a way to isolate ourselves from the elderly or those with underlying conditions until the vaccine arrived that would be great... but that is difficult to navigate too.
 
I like having a life too...
And I betcha if this takes (too) long, people are going to stop to care.
 
9:14 PM
Yeah... some already don't.
Never seen anything like this.
What's it like there @Derick ?
 
Too many covidiots... but I don't know today, as I stayed the f inside.
 
@Kalle I think we all do, but he always goes on 20 tangeants (I don't recall which email had a PS 3 times longer than the main body of the email lol)
 
I just emailed him this:
I'd suggest that if you want people to read your emails, you keep it
short, and infrequent. Right now, nobody is going to bother to read this
length, and I bet very few people are pleased with the amount of emails
*that* you send. Please don't waste everybody's time, and have a look at
the email etiquette:
https://github.com/php/php-src/blob/master/docs/mailinglist-rules.md
 
Thanks @Derick
 
I need to stop looking at this screen.
 
9:53 PM
I always use Gmail feature to callapse his responses without reading.
Sry for typos
@MarkR I think none of 4 languages with ctor args promotion has object initializer, but on the other side why only 4 has ctor args promotion - gives to think
 
... And Mike just replied to me off-list. I have NFI why.
 
10:17 PM
@NikiC Are any of the ideas I proposed harder/more impossible than I an estimating? Or did I manage to avoid saying anything stupid this time?
 
!!rfcs
 
!!xkcd
 
So excited to see everyone after my luxury cruise home from the World Handshake Championships!
 
@Crell I completely missed your mail between the spam. Gonna read it tomorrow
 
10:42 PM
o/ @PeeHaa
 
o/
 
01:00 - 18:0018:00 - 23:00

« first day (3446 days earlier)      last day (1484 days later) »