Hacker News Reader

Comment by Flimm | Hacker News Reader

These two lines of code are now deprecated, and will be removed in PHP 9.0. My question is: what will they do in PHP 9.0? Will they throw a syntax error? Or will they print something else?

  echo("${foo}"); // Will this print '${foo}' in PHP 9.0, or will it raise a syntax error?
  echo("${(foo)}"); // Will this print '${(foo)}' in PHP 9.0, or will it raise a syntax error?

Personally, I would prefer it to raise a syntax error. Otherwise, code that runs one way in PHP < 9.0 will run a different way in PHP 9.0, failing silently. I would prefer it to fail loudly.

View on HN

Even worse, it will reveal the variables used by your page to the user, which in some cases can be a security risk.

I assume it will raise a syntax error, as the PHP team is good about these things.

A syntax error would be \s fun though, would you have to escape the sequence in order to get that intentionally?

But that's also stupid because you cannot actually simplify the parser that much then, as you still need to detect it. And then you could just keep supporting it anyways, since it pretty much calls into the same code as the surrounding curly braces after that.

I mean, you could just set the parser to throw an exception if it ever detects anything other than a character (a-zA-Z) after an un-escaped dollar sign. Then you can just throw the same error, "Invalid string interpolation" so that no internal state of your program leaks, and you can immediately skip any subsequent memory reads for the contents of the variable.

If you have display_errors on, you have much security risk than this.

If you set error reporting to E_ALL I assume you will get a 'undefined variable {foo}'.

Which I think will be loud enough.

Personally, I would prefer if they just left working code alone.

Reply on news.ycombinator.com