Of representation and interpretation: A unified theory
summary
Many bugs trace to confusing representation with interpretation, so the concrete claims are: SQL escaping is representation not security; character encodings require explicit hints like Content-Type or a BOM; MB_detect_encoding is unreliable for ambiguous byte sequences; and PHP strings are byte arrays so building Utf8Bytes wrapper and RealString type or other injective representations prevents lossy conversions. The demo shows named constructors, type-wrapped byte sequences, and tradeoffs: correctness versus performance and engineering overhead.
AI-written summary · about
chapters (39)
- 0:00Intro
- 0:32Problems in programming
- 1:10Introduction
- 1:45Data
- 3:42Prime Numbers
- 5:04Data has different meaning
- 5:21Functions
- 8:22Mathematics
- 8:34Programming
- 10:26Money
- 11:50Representation
- 13:13Interpretation
- 13:45Why
- 15:19String escaping
- 15:29String escaping examples
- 17:40String escaping is not a security measure
- 18:04String escaping as a representation
- 19:00SQL literal
- 19:22JavaScript literal
- 19:56Magic quotes
- 20:36Use cases
- 22:28Injectivity
- 22:53Time
- 24:52Decode fromutf8
- 26:11Duck typing
- 26:28Detect encoding
- 27:17Interpretation of data
- 27:45HTTP headers
- 28:32Sheet music
- 28:53byte order mark
- 29:50variable name
- 30:23title HTML
- 30:56boot HTML entities
- 31:33string type
- 33:17String types
- 35:52String methods
- 37:46Fairy objects
- 38:50Recap
- 39:45Conclusion
related talks
39mOf representation and interpretation: A unified theory
54mSTRINGS ATTACHED: FROM ASCII TO 🙊🙈🙉
44mUNICODE + PHP for English Speakers
44mEnding Injection Vulnerabilities
46mHacking with Unicode in 2016
35mPHP is evil (Defensive programming)
48mEnding Injection Vulnerabilities
59mPHP's type system dissected?