« first day (3865 days earlier)      last day (1080 days later) » 

3:00 PM
function four($a, $b, $c, $d) { print "$a, $b, $c, $d\n"; }
$partial = four(?, d: 4, a: 1);
// step 1, copy the signature: $partial = fn($a, $b, $c, $d) => four($a, $b, $c, $d);
// step 2, splice in the fixed parts: $partial = fn(1, $b, $c, 4) => four(1, $b, $c, 4);
// step 3, remove constants from the signature: $partial = fn($b, $c) => four(1, $b, $c, 4);
 
@IMSoP As a concise reply to that, allow me to offer: chat.stackoverflow.com/transcript/message/52213563#52213563
Gah. Reply made less cool by using the wrong permalink. :p
 
"Acceptably viable" I can live with. :-)
(I was wondering...)
 
It's just another compromise that I wish we didn't have to make.
 
I still mildly prefer the optics of a separate "..." or "??", but with that mental model I do at least understand what the current "?" is doing
 
@IMSoP You and I understand it. I think people who don't eat and breathe this shit are going to have a harder time telling this story to themselves.
 
3:04 PM
I am literally about to go rewrite that section for the RFC, so I will do what I can to make it logical.
 
They'll probably have a functional understanding of "just collapse your question marks because nothing fucking matters anyway", but I don't think they'll generally grok the why of it.
 
I think most people will be able to grok that a trailing ? means 0 or more, while any ? to the left mean 1.
 
Right. That's the what. It's not the why.
 
yeah, because that's not actually what's happening
 
I don't love encouraging programmers to accept a what without a reasonable why
 
3:05 PM
That being said, I do think I'd prefer ... to be the trailing symbol.
 
/me hisses.
 
as I now understand it, the "?" is actually never standing for a placeholder, it's just a way of saying which argument to fix
 
I'm just willing to accept ? because I don't feel strongly enough about it.
 
Elipsis has a much better story, yes.
 
@IMSoP Right.
 
3:06 PM
@IMSoP Yep. And it's a terrible story.
 
@Sara What's your specific objection? Sorry I came late and I see lots of things about named arguments, but I want to be clear.
 
I feel like I need to hack the vote system so I can vote +0.1
'cause I can live with these awful, gross compromises, but yikes. Don't love 'em
 
the syntax most consistent with that mental model would be something like this: function four($a, $b, $c, $d) { print "$a, $b, $c, $d\n"; } $partial = four(2: 'hello', 4: 'world'); $partial(1, 2);" => 1, hello, 2, world
I'm not saying that's a good syntax, btw
just that it more closely describes the fact that only the fixed parts matter, and the "?" is just filler
 
@Trowski That we're telling programmers that '?' is a placeholder, unless it's many placeholders, but it's not really a placeholder, just use a '?' and don't ask what it's doing.
Honestly, I might like this approach to PFA if using named args for non-placeholders were a requirement
Then the fact that all other arguments were implied would be an easier pill.
$partial = four?(c: 3);
 
Random thought: What if we renamed "placeholder" to "partial marker" in the RFC/mental model?
 
3:10 PM
@Crell Gut-check, that probably wouldn't make a difference to me,.
 
@Crell I think there's a fundamental problem that the number of markers sometimes matters, and sometimes doesn't
 
@IMSoP points at nose
 
@IMSoP Joe fixed that.
 
no, I mean that foo(?, ?, 42) is not equivalent to foo(?, 42)
 
Not based on this conversation.
 
3:11 PM
<?php
function foo($one = 1, $two = 2, $three = 3) {
    var_dump(func_get_args());
}

$foo = foo(?); # On it's own, placeholder means 0 or more args

$foo();

$foo  = foo(?, 2, 3); # At the start means one arg

$foo(); # Filled by default, if no default error
$foo(5);

$foo = foo(1, ?, 3); # Mid-application, placeholder means 1 arg

$foo(); # Filled by default, if no default error
$foo(5);

$foo = foo(1, 2, ?); # On end means zero or more args

$foo(); # Filled by default, if no default error
 
Erm, then I think there's a misunderstanding.
 
that's inescapable, because you've got to decide which argument 42 fills
 
Where is ? ambiguous now?
 
the's the most concise description of what a placeholder is that we've had so far, it seems easy to understand to me ...
 
@JoeWatkins If that's true, then yay! Good.
It's inconsistent when conversation from the past hour though.
I'm inclined to believe Joe
Being as he's writing this.
 
3:13 PM
well that's how the patch works
 
;)
 
I think that matches my "new mental model"; let me work through
 
I think there was a confusion about four(?, d: 4, a: 1); // The single ? there is only possible because the arguments after it are named.
 
@JoeWatkins In $foo = bar(?, 2); may $foo be called with two args? Or is that an error? If not an error, then what does bar() receive?
 
So, what Joe said, BUT with the caveat of "and then any named arguments after that".
 
3:16 PM
krakjoe@Fiji:/opt/src/php-src$ cat test.php
<?php
function bar ($a, $b) {
    var_dump(func_get_args());
}

$foo = bar(?, 2);

$foo(1, 3);
?>
krakjoe@Fiji:/opt/src/php-src$ sapi/cli/php test.php
array(3) {
  [0]=>
  int(1)
  [1]=>
  int(2)
  [2]=>
  int(3)
}
 
function foo($one = 1, $two = 2, $three = 3) { }
$foo = foo(?);
// just copy: $foo = fn($one = 1, $two = 2, $three = 3) => foo($one, $two, $three)
$foo(); // makes sense

$foo = foo(?, 2, 3);
// start with a copy: $foo = fn($one = 1, $two = 2, $three = 3) => foo($one, $two, $three)
// splice in the 2: $foo = fn($one = 1, 2, $three = 3) => foo($one, 2, $three)
// make the signature make sense: $foo = fn($one = 1, $three = 3) => foo($one, 2, $three)
$foo(); // makes sense, both arguments are still optional
 
@JoeWatkins This case appears to need handling: 3v4l.org/SeZkZ/rfc#output
 
x: 1, filled in the first placeholder
 
@Trowski looks good to me?
 
@JoeWatkins Okay, so then your statement """$foo = foo(?, 2, 3); # At the start means one arg""" is false.
 
3:18 PM
that's how named params work ... position doesn't matter ...
 
@Sara I think the key is that the "?" doesn't add an arg, it just steps over an arg
 
@JoeWatkins Yes, but it's the partial call that seems odd. f(?, ?, x: 1). Why two ?
 
it says "don't splice anything for the first arg"
 
@IMSoP To me, the key is that additional, unspecified args at the end of a partial function are ALWAYS implied. Unconditionally.
I'm not against that, it's how userspace functions behave, but it should be clear, and examples like that don't make it clear.
 
f(?, ?) would be an error, so why not f(?, ?, x: 1)?
 
3:20 PM
@Sara no, the partial starts with all the parameters of the original function
no trailing args need to be added because they're allready there
that's why you don't need placeholders for them
 
Proposed text for the RFC:



In an argument list, positional arguments always must come first, followed by named arguments, if present. (This is the case already in PHP 8.0.)

The presence of at least one ''?'' in the positional argument list indicates that the expression is a partial application, not a function call, regardless of how many parameters the underlying function has.

A ''?'' at the end of the positional argument list indicates "import zero or more parameters from the underlying function."
 
Again, in Joe's example, the original function had fewer args, so that argument doesn't hold. It does have the implied any args of a userspace function though, so we're agreeing, but not for the reason you keep trying to convince me of.
 
(That text, followed by a bunch of illustrative examples.)
 
@IMSoP Understood. They are in fact partial calls. Something folks keep seeming to forget.
 
3:23 PM
so the calling convention for undeclared params just "falls through" transparently to the "real" definition
 
Sigh....
Tell me something else I already know.
It'll be great.
We can fill the chat with shit people already know.
 
@Trowski you're creating a placeholder and immediately filling during one application, application starts ( and ends ), the first ? is filled before the application has finished ...
 
You keep trying to tell me I don't understand and it's fucking condescending as shit, and I really don't fucking appreciate it.
 
upon second application (call), there is only one placeholder left ...
 
@JoeWatkins Ah, ok. Named args can be weird…
 
3:25 PM
And ya know, fuck it. Peace out.
 
Is my proposed text above clear enough and accurate enough?
:-(
 
That doesn't cause any actual problems, so I'm fine with it. Doubt anyone will actually use it that way.
 
no, but I see how it's confusing, my knowing how it works doesn't help anyone ...
 
@Crell I think the definition of trailing "?" needs to account for the fact that it doesn't matter whether you include it or not if you've got other placeholders
 
I don't know how to words
 
3:26 PM
@JoeWatkins You could consider limiting partial calls with named args to using a single leading ?
 
@Trowski Why?
 
That would keep it simple and unambiguous.
@Crell Because you're filling the args by name, not by position.
 
@IMSoP I think that's already accounted for, no? At least one ? means partial application.
 
@Sara my apologies; it's easy to misunderstand what someone else is misunderstanding, and talk round in circles
 
@Crell So f(?, name1: 1, name2: 2) is fine, but f(?, ?, ?, name1: 1, name2: 2) will error.
 
3:28 PM
@Crell yes, but this bit can easily be read as also needing a trailing "?" -> "A ''?'' at the end of the positional argument list indicates "import zero or more parameters from the underlying function."
those parameters are going to be imported from the underlying function as soon as you ask for a partial
the trailing "?" actually just means "turn this into a partial if you haven't already"
 
Incident with GitHub Actions, API Requests, and GitHub Pages ・ API Requests has Partial Outage ・ GitHub Pages has Partial Outage
 
@Trowski That.. is my understanding, but we should verify. Joe?
 
@Crell It doesn't error right now.
I also liked Sara's idea of putting a ? between the name and call, i.e. foo?(). You could completely kill trailing ? that way.
 
@IMSoP I haven't been following, did the discussion go full circle and ? is magic again?
 
@Sara I don't think he's trying to be condescending, rather misunderstanding that you would be misunderstanding something - rather than just leaving you could've told him earlier, more explicitly to stop, but oh well, we all do these mistakes sometimes…
But yeah the discussion is going in circles … we just should have a proper document describing the intracities and reasoning behind … which the RFC should actually be. If people don't understand the RFC properly, it needs more explanation/examples.
 
3:33 PM
@NikiC we're here
 
If ? is magical, following standard PHP rules, shouldn't it be __? :D
 
sorry
22 mins ago, by Joe Watkins
<?php
function foo($one = 1, $two = 2, $three = 3) {
    var_dump(func_get_args());
}

$foo = foo(?); # On it's own, placeholder means 0 or more args

$foo();

$foo  = foo(?, 2, 3); # At the start means one arg

$foo(); # Filled by default, if no default error
$foo(5);

$foo = foo(1, ?, 3); # Mid-application, placeholder means 1 arg

$foo(); # Filled by default, if no default error
$foo(5);

$foo = foo(1, 2, ?); # On end means zero or more args

$foo(); # Filled by default, if no default error
and now we're considering if more than one placeholder in an application containing named args is undesirable, because of how it behaves ...
 
@Crell how about this:

The presence of at least one ''?'' in the positional argument list indicates that the expression is a partial application, not a function call, regardless of how many parameters the underlying function has.

The function signature of the underlying function is copied, including types and default values.

Any positional argument other than ''?'' will be bound to that argument in the underlying function, and not appear in the signature of the partially applied function. A ''?'' is used to skip over parameters which you do not want to bind values for, and leaves the par
 
@JoeWatkins just ftr: this looks absolutely reasonable to me
 
@JoeWatkins Thanks
 
3:37 PM
@IMSoP Will merge that in.
 
the key insight for me has been that "?" isn't really a placeholder in the sense of "represents an argument", it's just filler to say "leave this parameter alone"
 
@IMSoP That's a good way to put it
 
and if you talk about it as "skipping over", it suddenly becomes obvious why you don't need multiple trailing markers
 
(Though I don't think those are good semantics -- just a good way to explain them.)
 
@NikiC what semantics would you prefer and why?
 
3:41 PM
@bwoebi I did, repeatedly.
 
@bwoebi The one where ? is a placeholder that represents a (required) argument :)
 
@IMSoP I like that.
 
@IMSoP Yet it's easy to listen to someone when they say, in no undercertain terms that they understand you. It's just as easy to ignore that and be condescending anyway.
 
@Sara maybe you intended to (yes, I see where you did), but I don't feel it was very explicit
 
@NikiC as a bit of Devil's Advocate, that does mean you can't have a partial with optional parameters, unless you extend the syntax to have something like foo(?=1, 42)
whereas the current model "inherits" defaults from the original function
 
3:43 PM
@IMSoP Indeed, and I do think that's fine
 
@bwoebi Then you're looking at a different occaision when I said, EXTREMELY EXPLICITLY, and I'm quoting the use of caps here, "I UNDERSTAND THAT. STOP TELLING ME WHAT I DON'T FUCKING UNDERSTAND"
But I can see how that might not be explicit enough...
I'll try to be more explicit than that in the future.
Much fucking apologies for my imprecision.
 
@Sara You just don't understand Sara
 
@Sara if you said that beforehand I'm probably just bad at reading the backlog, then sorry
 
well, all I can tell you is that my motivation was not to be condescending, I was genuinely trying to be helpful; evidently I failed
 
@NikiC Love you, sweetie.
 
3:47 PM
@Sara anyway, I think you know how to handle situations anyway and I don't actually need to say anything … felt I had to … but we're all just sort-of chaotic grown-ups :-P
 
I'm not a grown up, I'm like a 10 year old, I cry when people are mean to me and am paralyzed by anxiousness and frustration because I'm not able to express thoughts properly in words ... so, speak for yourself ...
 
@JoeWatkins +1
 
In an argument list, positional arguments always must come first, followed by named arguments, if present. (This is the case already in PHP 8.0.) The positional argument list consists of the parameters of the underlying function, excluding any that appear in the named argument list.

The presence of at least one ''?'' in the positional argument list indicates that the expression is a partial application, not a function call, regardless of how many parameters the underlying function has.

The function signature of the underlying function is copied to the created ''Closure'', in order, incl
(New text for the argument handling section of the RFC, replacing several other sections.)
 
@JoeWatkins the point of being grown-up is not being always like the ideal role model of a grown up, but being able to reason at times… an actual 10 year old has much more limited capability to reason than you do
the term is far too idolized …
 
I have some sympathy for this:
45 mins ago, by Sara
Honestly, I might like this approach to PFA if using named args for non-placeholders were a requirement
 
3:55 PM
(I will likely steal liberally from the RFC for the documentation, which I fully expect will be on me to write when the time comes.)
 
it's just so tempting to see the "?" as standing for something, rather than just being "in the way" so that you can fix a later parameter
 
I am not a grown up.
I am a kid trapped in an old and failing body of an elder.
 
@Crell All well if this one is fixed somehow: 3v4l.org/CvrtY/rfc#output
 
we should get t-shirts printed, someone make baby elephpant t-shirts with "we are not grown ups" on ... you'll be millionaires ... or, you'll make at least two sales ...
 
Plush ElePHPants with diapers on them, for Internals developers.
 
3:59 PM
My parents still give me crap for playing video games… so yeah, pretty sure I'm still 10.
 
@IMSoP Interesting idea. That would indeed make sense for these semantics.
 
@Trowski @JoeWatkins Your thoughts? (Right now spare placeholders are allowed, IF there are named args after them. Which seems weird.)
 
@Sara well, then I am as well, the classical definition of grown up implies a very boring person
 
@Trowski my husband says I'm about 6 ;)
 
@NikiC That's overly burdensome when most partial calls are going to bind a single param and skip 1 or 2 args.
 
4:02 PM
If I may summarize the past week: phpc.social/@pollita/106245711513814229
 
@Trowski depends on the length of the argument names: foo?(c: 42) is slightly shorter than foo(?, ?, 42)
 
sigh
 
@IMSoP In fairness, that's a red herring. Few arguments will be so concisely named.
 
@Sara yeah, was about to follow up with a counter-example, but I'm sure you can all imagine it
 
Assume most arg names are more than four characters long :P
 
4:05 PM
Though that approach does make me feel like having to use placeholders at all is the burden.
 
Aren't placeholders common in other language partials?
 
Few languages have anything this robust at all.
 
if you could target positional parameters somehow, you wouldn't need the string of placeholders: foo?(#3: 42)
 
OK, I've updated the RFC. Please review to make sure I didn't b0rk anything. The only remaining caveat is the "multiple ? when there are named args" question for Joe above.
 
@Trowski The alternative is to change the semantics wink wink
 
4:07 PM
@IMSoP Don't hate that completely, but I would favor the explicitness of names.
 
@NikiC What exactly do you have in mind? Drop the trailing placeholder?
 
28 mins ago, by NikiC
@bwoebi The one where ? is a placeholder that represents a (required) argument :)
 
Then I really like a ? before the partial call, because then we can drop the trailing placeholder.
 
Based on the comparison page I found before, nobody supports or named args, or named placeholders, or reordering arguments. Only Raku supports out-of-order placeholders, with a much different syntax.
/me can see the bikeshed color changing before his eyes...
 
foo?(); // No bound args.
foo?(1); // Bind first arg.
foo?(?, 2); // Bind second arg.
foo?(x: 1); // Bind by name.
 
4:12 PM
Hawkings law of bikeshedding. The shed must be painted in so many layers of paint that it overcomes its schwarzschild radius. VERY dense layers of paint.
 
I just finished updating the RFC text, guys...
 
@Crell How about a rainbow bikeshed?
 
We'll just cover it in flexible LED screens so people can change the color whenever they want.
 
How about we change the behaviour based on a declare() then everyone gets to be happy :P
 
/me shoots Mark in the face.
 
4:15 PM
@Crell the Rosettacode example for Raku is hard to follow, but this one in the manual looks quite similar syntax-wise to what we're discussing:
sub longer-names ( $first, $middle, $last, $suffix ) {
    say "Name is $first $middle $last $suffix";
}

my &surname-public = &longer-names.assuming( *, *, 'Public', * );

&surname-public.( 'Joe', 'Q.', 'Jr.'); # OUTPUT: «Name is Joe Q. Public Jr.␤»
 
?foo?(?, $x, ?)?
 
Yes, it's the closest equivalent.
 
@Crell Sorry, would you prefer an INI option
 
@SaifEddinGmati To make a partial call, lightly sprinkle ? over the call and hope for the best.
4
 
Don't forget that fancy Spanish upside down ?
 
4:17 PM
ooh, can we use the interrobang‽
 
Ooo, that sounds dirty. I like it.
 
it looks to me like Raku's * does always represent a single argument
 
Back to seriousness, @Crell @JoeWatkins what are you thoughts on:
8 mins ago, by Trowski
foo?(); // No bound args.
foo?(1); // Bind first arg.
foo?(?, 2); // Bind second arg.
foo?(x: 1); // Bind by name.
Then ? always means 1 argument.
 
At best it moves the ? to the side and introduces another syntax variant to think about.
I think with the current description in the RFC, with @IMSoP's additions, it's clear enough as is.
 
@Trowski I think going down that road, it may be best to just have a syntax for getting a callable (which is the most important use-case anyway) and leave the partial application to something like callPartial() on closure. Which is like a call, just that it returns another closure.
 
4:23 PM
F that.
 
At least I personally don't particularly care about the partial application part of this anyway
But yes, I imagine this may not be popular with demographics who are interested in partial application :)
 
I was actually thinking about a programmatic way to create partials, and this would fit reasonably well with the current semantics I think:
function foo($a, $b, $c) {};
$foo = foo(?, 42);
$foo = Closure::fromCallable('foo')->withFixedArgument(1, 42);
$foo = foo(?)->withFixedArgument(1, 42);
 
Named args already let you do that.
 
Ugh… I concur with Larry. F that.
 
I'm not ignoring ya'll, I just don't have ready made answers for the questions you're asking ...
@Trowski at a glance I don't like this at all ...
 
4:31 PM
@JoeWatkins Just look at the possible error in trailing ? handling with named args. :-)
 
Then fix the named arg weirdness and I think the current version is good to go.
 
@Crell was that a reply to me? if so, I don't understand it
 
foo(?, ...$args); // Partial of foo(), with some args bound by name already, the rest being placeholdered. You can build up $args programmatically.
I should add that to the example block.
 
so, kind of like Sara's "named non-placeholders only"
foo(?, ...['c' => 42]);
(obviously, you wouldn't actually write that)
 
You can do it that way, absolutely.
Just added an example to the RFC:

function four(int $a, int $b, int $c, int $d) {
    print "$a, $b, $c, $d\n";
}

$args[
  'd' => some_computation_that_returns_4(),
  'b' => 2,
];

$p = four(?, ...$args);

$p(1, 3); // Prints 1, 2, 3, 4
 
4:40 PM
that will probably feel natural once I've used PHP 8 for a bit and the idea of unpacking keys into parameter names isn't so alien :)
 
:-)
 
(I'm really looking forward to using named parameters)
 
I think 99% of my named param usage is flags: for json_encode / decode
 
the oldest section of the legacy code base I work with used $params arrays to emulate named params
which sounds cool, but half the functions don't document the keys, and do things like function foo($params) { $params['is_foo'] = true; bar($params); }
 
Part of what I <3 about TS is how easy it is to do inline interfaces and then create them without needing an array
foo(): { a: number, b: number, c: number } { ... }
 
4:47 PM
yeah, I think PHP really needs a syntax for capturing values into an anonymous class
 
@IMSoP I'd wonder what referencing them from inside the class would look like. Would they just be promoted to public props?
Or just scope defying "localish" vars?
 
@IMSoP I have a whole presentation I give on the evils of that. :)
Speaking of anon classes, how complicated would it be to allow an anon class to extend a class defined at runtime instead of compile time? Is that impossible or just we never thought about it?
 
@Sara I was thinking something like $foo = 42; $obj = new class { public int $id = use $foo; } echo $obj->id; // 42
i.e. some way of explicitly saying "this is a value binding, not a name"
right now, the best you can do is a promoted constructor property: $foo = 42; $obj = new class($foo) { public function __construct(public int $id){} } echo $obj->id; // 42
CPP makes it better, but it's still spaghetti
 
new class + property promotion is useful, except you can't then use that same class definition as a func arg
TS treats them like shapes, passing if all the variables are there with the same names and types
 
@MarkR ah, yes, I see what you mean
 
4:54 PM
I wish I understood lexing, parsing and all that sufficiently well to troll a joke like "JuSt HEaR mE OuT $f ?= ?whole(1,?,3,?)?;" and that it actually made sense
 
How about $foo = 42; $obj = new class use ($foo as $id) {}; echo $obj->id; // int(42)
Don't actually love that, mind you. Just spit-ballin
 
yeah, that's not too awful
 
...use (&$foo as $id) if you need it by ref.
 
could maybe allow modifiers too: $obj = new class implements SomeThing use ($foo as private int $id) { /* method using $id relevant to the interface */ }
 
Visibility is just public, no other option. Because this is a local ephemeral class with one instance. Visibility is less of an issue.
I do like being able to add type...
And at that point, the visiblity modifier helps reduce ambiguity...
 
4:57 PM
I think visibility would be a niche case, but useful occasionally
 
I'm not ruling it out, just dubious.
 
as in that example, I can imagine using it with interfaces
e.g. to create a quick proxy without exposing the inner object
 
Ah. yes.
Private has that handy property of completely avoiding property conflicts as well
 
true
 
@Crell, can I send you a follow up email on the is_literal RFC, I just want to make sure I've covered all of your thoughts (it should only take 4 minutes to read)... if so, can I use your garfieldtech email address?
 
5:00 PM
So yeah... without thinking it all the way through.... I think I don't hate it.
 
@CraigFrancis Go for it.
 
@Crell Thanks, sent... If you do have any thoughts/questions, I'll be here for the next hour and a half (7:30 GMT), and most days next week.
 
Is this something you plan to send to the list? Or just to me? Or me and select others? What's the context?
@CraigFrancis ?
 
@Crell The RFC itself will be going to the list, hopefully next week (assuming Dan's ok with it)... but you talked about a few specific things last month, I didn't do a good job of explaining myself at the time, so I've hopefully answered those questions.
 
All issues have been resolved!
 
5:06 PM
So this is aimed mainly at me, OK. Your use of lots of Drupal examples is therefore odd. :-)
 
Ahh, yes, sorry, at the time you were using Drupal examples.
 
ziparchive.addglob subfolder bug ・ *Directory/Filesystem functions ・ #81044
 
If memory serves, I had two main issues before:

1. You were presenting is_literal as a silver bullet that guaranteed security, rather than another tool to reduce the potential for security holes. That's a marketing/presentation question, not technical one. The answer here is to be more honest that this approach reduces the attack surface, but doesn't eliminate it entirely.
The burden of proof that it helps security is reasonable and achievable. The burden of proof that it eliminates all security holes is astronomically high.
 
@Crell Fair, and I think IMSoP has really helped me update the RFC to change that.
 
I haven't read the new text yet, will do so shortly.
2. My biggest concern was with query builders, ORMs, etc. using is_literal naively, and then blocking certain use cases that would otherwise be safe.
 
5:17 PM
Thanks... and yes, I was thinking in absolutes, because my own projects do use SQL strings that are made out of literals (strings defined in my PHP scripts), that allows me to say there is no user data in them... but ORM's can still work with them to a similar position.
@Crell So yes, that's the next bit I'd like to understand more about.
 
For example, if a query builder doesn't support WITH clauses, or system versioned tables, or other advanced fancy functionality, then if I want to be more dynamic in the query that is run, I have to build it manually. However, if the DBAL checks is_literal, then I am unable to do so.
There's probably some equivalent here for JSON-based storage, too, but I am less familiar with Mongo et al.
 
ok, I do dynamic queries in my projects, and I've been testing them against Joe's implementation, and it's been working really well... so I wonder if it's just a distinction of what a literal is?
you have a point about taking table and field names from the user (as you mentioned Drupal can do), and that would need to use it's own validation rules (bypassing the is_literal check)... but everything else, that's just concat of literal strings for the SQL.
 
No, I think it's more a matter of how robust we expect query builders to be. :-)
Code from a project I was working on a while back:

$this->conn->executeUpdate('UPDATE '.$table.' SET default_rev = :default WHERE uuid = :uuid AND language = :language AND NOT revision = :revision ', [
':default' => 0,
':uuid' => $uuid,
':language' => $language,
':revision' => $revision,
]);
 
cool, ok, so where does $table come from?
 
The table name there is based on the collection name, which is user configuration. So $table can never be truly literal.
Natural answer: OK, then you should be using a query builder instead of a direct query. Fair enough!
But that assumes that my query builder supports update statements, and that it will NOT do an is_literal check on the table argument.
Because if it does, I'm SOL.
 
5:24 PM
ok, in this example, considering this is very much in the world where the user is providing the table name (i.e. it has to be validated anyway)... could it start 'UPDATE {table} SET ...', then executeUpdate() would be able to check it is_literal(), then do the validating and applying the table name?
btw, I'm using {table} as I've just been reading the Drupal documentation, where it uses this format for table definitions.
$this->conn->executeUpdate('UPDATE {my_table} SET default_rev = :default WHERE uuid = :uuid AND language = :language AND NOT revision = :revision ', [
':default' => 0,
':uuid' => $uuid,
':language' => $language,
':revision' => $revision,
], [
'my_table' => $table,
]);
or something like that
 
Then the query builder has to have context-sensitive string parsing for arbitrary places. Which is... hard, and undermines the is_literal check to begin with
Here's a more complex example: Are you familiar with SQL WITH clauses?
 
A bit
 
modern-sql.com/feature/with for a very brief overview good enough for now.
AFAIK, neither Drupal or Doctrine's query builders support WITH clauses.
So now I want a WITH clause, that means I cannot use the query builder. I have to do it myself.
 
ok, so you're back to using executeUpdate?
sorry execute()?
 
Right.
OK, fair enough, I know how to assemble SQL queries dynamically, and I'm a reasonably security-educated person so I know what steps to take to be reasonably confident that there's no holes in it.
 
5:30 PM
@Crell @NikiC To be clear, I don't think RFC authors are on the same page of what we should be targetting.
 
But if there's an is_literal() check on execute()'s first parameter, bam, I'm blocked.
 
yeh, but I don't want to rely on that either
 
Joe is very ready (and convinced) to say that named arguments will just never work, just block them and move on.
I am on the same page in that if we ignore named parameters, what Joe outlined above is pretty reasonable and good.
 
@LeviMorrison Named placeholders, specifically. Named arguments (with actual values) work totally fine.
(I have to leave for an appointment in a moment, so trying to wrap up here.)
 
But I think ignoring a language feature is a bad idea. We should seriously try before just giving up.
 
5:31 PM
@Crell I think execute()'s first parameter could be a literal though.
 
Joe was trying to explain to me about function prologue and how that affects things, but I didn't follow. I need to go read it again.
 
$query = "WITH $name_ive_secured_myself AS SELECT * FROM $table_ive_already_secured_myself WHERE ...";

// That will never work if there's an is_literal check, but there's no other way for me to get that query into the DBAL.
My issue is trading security for ability to even write certain queries at all.
 
Ok, what does $name_ive_secured_myself contain?
 
And that's not a trade off I'm comfortable with.
 
is that a literal?
as in, $name_ive_secured_myself = 'my_name'; ?
 
5:34 PM
It's a string value that I've computed off of... I don't even know what at the moment. :-) Some user configuration, stored in a different table somewhere, probably.
 
BTW, ? doesn't work variadically with IN, so if you need to see if some id is in a range like IN (?, ?, ?, ?) that query is probably generated dynamically.
 
Another good example.
 
@LeviMorrison That's covered in the RFC
 
I must depart now, appointment to get to.
 
5:59 PM
@LeviMorrison @Crell ping
oh, one of you is gone, other one ?
 
I think @Crell went for an appointment
 
I'm here.
 
I think I have something workable
 
For what version of the spec? lol
But still, I'm all ears :)
 
the rules for positional application are unchanged
the rules are thus for named parameter interaction:
any application containing named args must not contain more than one placeholder (intend to restrict to position 0)
any application containing named arguments must use all named arguments
any application using named arguments must also use named arguments in further application (including call)
 
6:06 PM
@JoeWatkins $f = foo(?, z: 1); $f(1); // Error, must used named args in call?
 
yes
 
The first two points sound great, but why the third?
 
// I think the rule helps avoid this issue:
function f($x = 0, $y = 0) {}
f(y: ?)(1); // is $x =1 or $y = 1
(or some variant to it)
 
@Crell This example shows how the WITH query, with table names from the user, could work: gist.github.com/craigfrancis/901aa0479379fe9c261ccb2e33ebdcd7
 
@JoeWatkins Would you be interested in getting on a call ? I don't know what time it is there. I'm working on defining things in a more spec-like language.
 
6:21 PM
Hello everyone, Laravel question. If you have a Product model and return multiple products, however you also want to return an average rating for each product (needs to be calculated) from a rating relation. How can this be achieved?
 
@LeviMorrison I don't care for that ambiguity, so point three makes sense now too.
 
I'm working on cohesive rules that are more defined than they are now. I think we can "fully" support named parameters.
 
With those rules, I think the proposal makes sense, covers most use-cases, and leaves potential extension open.
@LeviMorrison Based on the current patch, just more defined? Or another approach?
 
I mean modeling how it would work, not implementing it.
 
okay done, writing tests ...
@LeviMorrison must not loose focus now ...
 
6:35 PM
No worries ^_^
 
7:28 PM
/me is back, briefly.
@JoeWatkins I... do not see why we would do that, and think it's actually bad.
 
> any application containing named args must not contain more than one placeholder (intend to restrict to position 0)
placeholders are inherently positional in nature, as such in a call with named arguments they can only confuse, they are all unnecessary, one is required to make application partial
agree ?
> any application containing named arguments must use all named arguments
 
Those two go together, but I am not yet convinced.
 
Not sure. I'm still working on a model for named arguments + placeholders.
 
> any application using named arguments must also use named arguments in further application (including call)
this resolves argument reordering, it's the only way to make sense of using named parameters over more than one call site, and gives people the behaviour they expect ...
 
I haven't used named args much in the wild yet, so I don't have a good intuitive sense of when you'd be mixing them. Python may be more illustrative here.
The 3rd one I an decidedly against. If I'm partialing a function such that there's only one argument left, why the frack would you force me to use its name?
 
7:36 PM
under this model, named placeholders become totally superfluous - they are all implied by the required initial ?, support for an explicit placeholder would serve no useful purpose
 
That comes together to say "if you have a couple of flags you want to use with named params and partial, we're taking the easy call mechanism away from you."
(Yes, yes, flag-args bad, but named args are explicitly a way to make them less bad. That's a direct use case for named args.)
 
it's the problem of positional arguments cannot come after named arguments, you have to think about the fact we have to deal with the current rules, and that we're spreading what is one call over more than one site, but the rules still apply, it doesn't make sense to accept a bunch of named arguments and then positional arguments, named parameters don't support that
 
(I have only about 15-20 min before I have to disappear again, FYI.)
With named args now, what happens if you pluck out a named arg from the list?
 
this leaves the door open for the named parameters implementation to be improved to the point where it can support accepting positional args after named ones, and then we can follow suit in partial application ... or it will (almost) work by accident ...
 
I have a rough draft spec that works with named parameters: gist.github.com/morrisonlevi/f7cf949c02f5b9653048e9c52dd3cbfd.
 
7:42 PM
 
> From left to right, examine each argument.
you know we don't have information about which arguments are named or not
 
Of course we do. Maybe not in your implementation, but we have it in the AST.
 
sure, we don't keep that information
 
I don't know what you mean. We have ZEND_AST_NAMED_ARG in the AST, we can change how we compile it.
 
we don't have unlimited space to store stuff, and can't add additional branches in every send opcode ...
 
7:51 PM
So, there's 2 things that I think this direction makes invalid, and I object to being invalid:

$p = func_with_8_args(?); // Levi's writeup seems to imply this is invalid, you need all 8 ?

$p = five(?, b: 2, c: 3, d: 4, e: 5);
$p(1); // No name used here, even though it's patently obvious that it's for argument a.
 
@JoeWatkins Stop worrying about implementation at this point, and worry about semantics, like Crell ^_^
@Crell Yes, it's invalid. Do func_with_8_args(...) instead.
@Crell Why is five invalid?
 
-1 to any more symbols.
@LeviMorrison From Joe's list, item 3: any application using named arguments must also use named arguments in further application (including call)
 
Joe's list has nothing to do with what I just specified. five is valid.
 
I expect the primary usage of this feature to be in pipes, which want single-param functions, or referencing a function to avoid making it a string. Let's not make those two use cases worse. :-(
Oh great, so you two have two different competing change proposals. :-)
 
I agree with @Crell, the ambiguity on a partial called with named args is a not big deal if the subsequent call doesn't used named args. Users will quickly figure out how they messed up from the error messages.
@Crell Right, most uses aren't as contrived as the examples we're creating.
 
7:55 PM
Based on the quick test I did above, I think we should modify the RFC from what I wrote earlier to not "pluck out" named args from the list, as that's not how named args work now anyway. (my error.) Otherwise, I don't see why we need to revise anything else.
 
The document I just posted supports positional placeholders, named placeholders, and variadic placeholders, and everything is defined and I think also useful.
Please consider it.
Don't worry about implementing it. Focus on semantics.
Also, we have positional arguments, named arguments, and variadic unpacking arguments; the placeholder types correspond to these same things.
 
I don't know from implementation, I leave that to Joe. :-) But semantically I do not like ... instead of ? for what is likely the most common use case.
 
I can't separate semantics from implementation details, if the semantics you're suggesting are unreasonable because of the implementation details it implies, I can't ignore that ...
 
(One of the two, anyway.)
 
@JoeWatkins Just try.
@Crell Which are?
 
7:58 PM
Gotta go now. 2 hour meeting.
As I said above:
1. currying a function to single parameter for use with pipes
2. referencing a function without binding anything so you can use it instead of the stupid [$obj, 'method'] BS
/me poofs.
 

« first day (3865 days earlier)      last day (1080 days later) »