[PHP-BUG] Req #79359 [NEW]: Literal checking

From:             craig at craigfrancis dot co dot uk
Operating system: 
PHP version:      Next Major Version
Package:          PHP Language Specification
Bug Type:         Feature/Change Request
Bug description:Literal checking

Description:
------------
Following up on the PHP Internals mailing list[1], and a similar idea by
Matt Tait[2].

PHP should allow developers to check a variable was created from
Literals.

By checking a variable `is_literal()`, it would allow us to enforce the
use of parameterised SQL queries, at run time.

It would also be helpful for ORM's to ensure they don't introduce
issues[3].

This is not the same as Taint Checking[4], as that allows you to use
untaint(), and does not protect against issues like missing quotes:

  $sql = 'DELETE FROM ... WHERE id = ' . mysqli_real_escape_string($db,
$_GET['id']);

  /delete.php?id=id

Note that string escaping is only "theoretically safe"[5] - typically
due to character encoding issues.

And while SQL injection is easy to demonstrate, this can also protect
against Command Line Injection, and to a certain extent, HTML Injection
- as these would benefit from having a string known to be safe (made
from literals), with user values being supplied separately.

Internally it would need to introduce a flag on every variable, and a
single `is_literal()` function to check if a given variable has only
been created by Literal(s). Unlike the taint extension, there should be
no way to override this. And certain functions (e.g. mysqli_query) might
use this information to generate a error/warning/notice in the future.

This is being discussed for JavaScript, via TC39 [6], to support the
introduction of Trusted Types.

[1] https://news-web.php.net/php.internals/108537
    https://news-web.php.net/php.internals/106625
    https://news-web.php.net/php.internals/106631

[2] https://wiki.php.net/rfc/sql_injection_protection

[3] https://framework.zend.com/security/advisory/ZF2014-04
    https://framework.zend.com/security/advisory/ZF2016-03

[4] https://github.com/laruence/taint

[5] https://www.php.net/manual/en/pdo.quote.php

[6] https://github.com/tc39/proposal-array-is-template-object
    https://github.com/mikewest/tc39-proposal-literals

Test script:
---------------
<?php

    define('TABLE', 'example');

    $in_sql = substr(str_repeat('?,', count($ids)), 0, -1); // To create
'?,?,?'

    $sql = 'SELECT * FROM ' . TABLE . ' WHERE id IN (' . $in_sql . ')';

  is_literal($sql); // Returns true

    $sql .= ' AND id = ' . mysqli_real_escape_string($db, $_GET['id']);

  is_literal($sql); // Returns false

?>


-- 
Edit bug report at https://bugs.php.net/bug.php?id=79359&edit=1
-- 
Fix committed:                    https://bugs.php.net/fix.php?id=79359&r=fixed
Fixed in release:                 https://bugs.php.net/fix.php?id=79359&r=alreadyfixed
Need backtrace:                   https://bugs.php.net/fix.php?id=79359&r=needtrace
Need Reproduce Script:            https://bugs.php.net/fix.php?id=79359&r=needscript
Try newer version:                https://bugs.php.net/fix.php?id=79359&r=oldversion
Not developer issue:              https://bugs.php.net/fix.php?id=79359&r=support
Expected behavior:                https://bugs.php.net/fix.php?id=79359&r=notwrong
Not enough info:                  https://bugs.php.net/fix.php?id=79359&r=notenoughinfo
Submitted twice:                  https://bugs.php.net/fix.php?id=79359&r=submittedtwice
register_globals:                 https://bugs.php.net/fix.php?id=79359&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=79359&r=phptooold
Daylight Savings:                 https://bugs.php.net/fix.php?id=79359&r=dst
IIS Stability:                    https://bugs.php.net/fix.php?id=79359&r=isapi
Install GNU Sed:                  https://bugs.php.net/fix.php?id=79359&r=gnused
Floating point limitations:       https://bugs.php.net/fix.php?id=79359&r=float
No Zend Extensions:               https://bugs.php.net/fix.php?id=79359&r=nozend
MySQL Configuration Error:        https://bugs.php.net/fix.php?id=79359&r=mysqlcfg