I think using getType() instead of getClass() is plain wrong. You need to actually check whether the type is a class (might be fiddly), and otherwise return NULL.
I don't understand wat zend_compile_expr_inner is doing, so got stuck there setting the flag on the strings at what I thought was an appropriate place.
@Andrea I think that is best solved by coding conventions though, like, inline queries as in ->query("SELECT 1") must not contain variables. And then for the couple times where you need an assembled query, you just apply due diligence.
lol. so er, auryn uses phpunit 4.something. phpunit 4.something uses the function each. that function is deprecated in 8.0, the version which actually has the problem.
I had - a couple months ago - someone do sql-injections, like one request per second … And I was observing him live (and fixed it like 1 min after detecting that) - the main problem was just that I hadn't followed conventions when writing that code. Thus, I added a small static analysis to our deploy pipeline to catch that (and uncovered a couple more vulnerable places, with exactly that same problem).
so er, @Danack or @Trowski, or to whom it may concern, if I were hypothetically to try and update auryn's phpunit version to something higher than 4, do you think I should go strongly all the way up to 9, or simply 5.7 (which allows my test to fail in the desired place) and maybe have more chance for it to actually happen?
@bwoebi yeah, developer education doesn't scale though. It should be possible to write libraries that are safe to use, without a more senior developer watching for naive errors. Or having to remeber/bother setting up very specific CI tools to detect.
@FélixGagnon-Grenier maybe just open an issue. If we're going to officially move git repo, we may as well discuss dropping PHP 5.4 support.....