Re: [RFC] Name issue - is_literal/is_trusted

On Tue, Jun 22, 2021 at 8:11 PM Craig Francis <craig@craigfrancis.co.uk> wrote: > > The Function: > - Is a security-based function that prevents Injection Vulnerabilities in > PHP. > - Flags strings written by the developer, including when concatenated. > - Also accepts integer values, which as purely numerical cannot contain > code/dangerous characters. (Due to technical limitations within PHP, it's > not possible for these to be flagged as user or developer in the codebase > itself without performance issues). > - is_safe_from_injections()? - is_secure_against_injections()? - can_be_trusted_to_not_contain_injection_vulnerabilities()? (okay not this one) Alternatively, if integers are too controversial, how about reverting the implementation to is_literal() but provide a function like to_literal(int $int): string (or just a "polyfill" for userland, could be a one-liner `implode(array_map(fn ($c) => ['0','1','2','3','4','5','6','7','8','9','-'=>'-'][$c], str_split((string)$int)))), so that those implode(',', [1,2,3])` could use implode(',', array_map('to_literal', [1,2,3]))? Regards, -- Guilliam Xavier