[PHP-DEV] Re: Literal / Taint checking

2020-02-13 Thread Craig Francis
Hi, While there was a brief discussion about an *is_literal*() method in August, I'm wondering where I can go next? Just as a reminder, the main objection seemed to be that Taint checking is the current solution. For example, those created by Laruence[1], MediaWiki[2], and Matthew[3]. But this ca

[PHP-DEV] Re: Literal / Taint checking

2020-03-09 Thread Craig Francis
Hi, As I'm not sure how to make any more process on this, I've added added a Feature Request: https://bugs.php.net/bug.php?id=79359 It shows how this change in PHP could stop SQL injection, and proposes a way it could be used against HTML injection as well. Craig On Thu, 13 Feb 2020 at 12:31

Re: [PHP-DEV] Re: Literal / Taint checking

2020-03-09 Thread Rowan Tommins
On Mon, 9 Mar 2020 at 13:47, Craig Francis wrote: > Hi, > > As I'm not sure how to make any more process on this, I've added added a > Feature Request: > > https://bugs.php.net/bug.php?id=79359 > > It shows how this change in PHP could stop SQL injection, and proposes a > way it could be used aga

Re: [PHP-DEV] Re: Literal / Taint checking

2020-03-11 Thread Craig Francis
On Mon, 9 Mar 2020 at 16:54, Rowan Tommins wrote: > [...] the way to get a more in-depth discussion going is to draft an RFC Thanks Rowan, I've created a Wiki account (craigfrancis), and I believe the next step is to ask for RFC karma? And is there is anyone who can help with the technical d