3 ms·

These two lines of code are now deprecated, and will be removed in PHP 9.0. My question is: what will they do in PHP 9.0? Will they throw a syntax error? Or wil

by Flimm 4y ago

These two lines of code are now deprecated, and will be removed in PHP 9.0. My question is: what will they do in PHP 9.0? Will they throw a syntax error? Or will they print something else? echo("${foo}"); // Will this print '${foo}' in PHP 9.0, or will it raise a syntax error? echo("${(foo)}"); // Will this print '${(foo)}' in PHP 9.0, or will it raise a syntax error? Personally, I would prefer it to raise a syntax error. Otherwise, code that runs one way in PHP < 9.0 will run a different way in PHP 9.0, failing silently. I would prefer it to fail loudly.

sam_goody 4y ago
Even worse, it will reveal the variables used by your page to the user, which in some cases can be a security risk. I assume it will raise a syntax error, as the PHP team is good about these things.
- tuxone 4y ago
  A syntax error would be \s fun though, would you have to escape the sequence in order to get that intentionally?
- iforgotpassword 4y ago
  But that's also stupid because you cannot actually simplify the parser that much then, as you still need to detect it. And then you could just keep supporting it anyways, since it pretty much calls into the same code as the surrounding curly braces after that.
  - mtrpcic 4y ago
    I mean, you could just set the parser to throw an exception if it ever detects anything other than a character (a-zA-Z) after an un-escaped dollar sign. Then you can just throw the same error, "Invalid string interpolation" so that no internal state of your program leaks, and you can immediately skip any subsequent memory reads for the contents of the variable.
- innocenat 4y ago
  If you have display_errors on, you have much security risk than this.
blenderdt 4y ago
If you set error reporting to E_ALL I assume you will get a 'undefined variable {foo}'. Which I think will be loud enough.
userbinator 4y ago
Personally, I would prefer if they just left working code alone.

by Flimm 4y ago

sam_goody 4y ago

Even worse, it will reveal the variables used by your page to the user, which in some cases can be a security risk. I assume it will raise a syntax error, as the PHP team is good about these things.

tuxone 4y ago
A syntax error would be \s fun though, would you have to escape the sequence in order to get that intentionally?
iforgotpassword 4y ago
But that's also stupid because you cannot actually simplify the parser that much then, as you still need to detect it. And then you could just keep supporting it anyways, since it pretty much calls into the same code as the surrounding curly braces after that.
- mtrpcic 4y ago
  I mean, you could just set the parser to throw an exception if it ever detects anything other than a character (a-zA-Z) after an un-escaped dollar sign. Then you can just throw the same error, "Invalid string interpolation" so that no internal state of your program leaks, and you can immediately skip any subsequent memory reads for the contents of the variable.
innocenat 4y ago
If you have display_errors on, you have much security risk than this.

blenderdt 4y ago

If you set error reporting to E_ALL I assume you will get a 'undefined variable {foo}'. Which I think will be loud enough.

userbinator 4y ago

Personally, I would prefer if they just left working code alone.