Craig Francis

@tim, Thanks, I think that's about right, and while I would be surprised to see a developer do those specific examples, I suspect there are cases where the end of a string could be cut off as the developer intends, but by allowing an arbitrary value (what could go wrong?) it could cause issues (I'm still waiting for the person asking for it to give me an example where it would be useful).

@MarcusMüller, I think we're looking at two different things... I'm saying that a literal string is safe from injection vulnerabilities, I'm not saying it's safe in general... classic example, the command string 'rm -rf ?' is a literal, it's not vulnerable to injection issues (it does not include a user value, which would be correctly quoted by something that knows how to do that)... but it's not safe when the path gets get to '/'... and I think your example demonstrates that difference.

@thedefault. Just checking... if you had $sql = "'"; that's a literal, but it would be down to the programmers code to incorporate it in weird ways, all under the programmers control... so yeah, I think it is essentially a constant string, and safe (from injection vulnerabilities)... but I want to make sure I've not missed anything that a programmer could realistically do, and cause an issue somehow.

There is no way to say something is trusted (e.g. no untaint function)... I tried to explain that a few times in the RFC, because that would cause the issue you raise (it's why this RFC is not implementing a traditional taint based system, which does cause a false sense of security).

But the order those strings are concatenated will still be done by the programmer? so unless the programmer intentionally writes them to be joined in an evil way (they wrote that code), it's not going to be an issue, is it?

Can you think of an 'exploitable' string... I'm going on the basis that the SQL should be written by the developer (aka strings from the PHP source code).

@MarcusMüller I'm trying to finalise that list at the moment (why the question on splitting was raised, which I feel uncomfortable including, but couldn't really prove why)

Erm... concatenating of literals is fine... it happens with SQL strings all the time, it's when the concatenation includes a non-literal string that you get a "prime source of injection"

@MarcusMüller, btw, I'm happy to discuss in non-comments (I'm "craigfrancis" on Twitter, can use Zoom/GoogleChat/etc), I'm hoping to get the RFC ready for next week, and I'm a bit concerned that you're reading it that way.

I think so too, and I think your comment a really nice way of putting it... while I'd like to give an example to prove that's the case, I think it's hard to come up with something that would be shot and realistic.

Thanks @MarcusMüller, I tried to keep it short, and made it much harder to understand... does the example and context help?