Hacker News new | ask | show | jobs
by GeorgeTirebiter 1506 days ago
Indeed, if "{value} is bad" can be automatically f-stringed by an external program automatically --- then why can't Python do this automatically -- so we can get rid of the f-string type as a required explicit declaration? After all, we don't specifically add a type to a number like 42 or 3.14159 --- those are implicitly 'int' and 'float' types.

I would use such a feature, as I always use f-strings when formatting.

4 comments

> Indeed, if "{value} is bad" can be automatically f-stringed by an external program automatically --- then why can't Python do this automatically -- so we can get rid of the f-string type as a required explicit declaration?

Because it would break existing strings containing braces, such as those used with `str.format`, or string.Template, or literal Jinja templates, ...

Yes, my use case was "I always use F-strings" so these other breakages could not occur, by definition.

I suppose it's not that much of a problem to run a program to preprocess source and add in the F

But.. Python has a history of introducing new features that break old ones. That seems to me a balance between backward compatibility and future goodness.

the "from future import auto-fstring" construct could do it...

And, as for having to run the f-string parser: yes, but only once on static strings, which are most of them.

It's not clear to me that folks would want this behavior globally - I personally would not, because sometimes I want to be able to include curly braces in my strings without it being interpolated, and I prefer the current syntax of having that just work. I'm very comfortable with having to add the 'f' to the string syntax to declare that this particular string should be interpolated.

There are other issues you'd have to deal with as well. Would you interpolate non-literal strings (e.g. in the code `print(input())`, if the user inputs the string "{1+1}", what would be printed?)? How would you propose dealing with jinja and other strings that typically contain curly braces that should not be interpolated? This could also be an issue with (potentially long) strings containing lots of random characters: if a '}' showed up in a string somewhere after a '{', even if separated by tens or hundreds of characters, then you'll run into errors. This could be a problem if you're dealing with pseudorandom or base-92 encoded strings, or even just strings representing code (imagine a python library that generates C++ or Java code which has lots of hard coded strings with braces).

I think overall, having to specify that a particular string should be interpolated is a better solution than having to specify that a string should not be interpolated.

Well, you could put a N" your string with{} in it" to type-specify that you are not F-string. In fact, WHY are strings not fully specified every time? There is nothing wrong with F"This is also an f-string". After all, strings are just number sequences with special meanings assigned to some values in some circumstances.

Seems to me the problem is similar to wanting 1 be interpreted as an int --- if you want float, you change the syntax (and therefore semantics) to 1. or 1.0

It's always possible to conjure corner-case failure modes; but shouldn't the 'common case' be catered to, more than some base-92 encoded strings?

And, by the by, more 'smarts' can be applied to automatic f-string determination. If "{variable-that-exists} foobar" is seen it could plausibly be converted to an f-string.

This leads into a much longer discussion of how our compilers/interpreters are too stupid today, and need to up their game. But probably not here, not now.... and also, thank you for your observations & comments.

> It's always possible to conjure corner-case failure modes; but shouldn't the 'common case' be catered to

It is: normal strings are the common case.

That's true, 'normal' strings are the common case -- IF what you are doing requires the use of 'normal strings'. If you are doing formatting for output, then the 'normal' string is an f-string.

As to 'injection' attacks -- I have no sympathy for somebody who takes user input, does not check it, and throws it at SQL. All user input should be checked 7 ways from Sunday before it's even passed to a part of the program that's supposed to deal with said input.

From my perspective, I'm just trying to say "there has got to be a better way". yes, we can survive, but -- as the OP shows -- a bunch of auto-fixed bugs went away. Why were the bugs there in the first place?

I have a saying that programmers spend too much time debugging; and if they would just not put the bugs in, in the first place, debugging could be reduced. To do that, you need help from your language. Other things also matter, sure. But give me constructs that make it hard for me to screw up.

> And, by the by, more 'smarts' can be applied to automatic f-string determination. If "{variable-that-exists} foobar" is seen it could plausibly be converted to an f-string.

One obvious and dangerous application of these "smarts" is when people expect curly braces to be treated as string literals. What if a string contained an example f-string that contained {sensitive-server-information}? It's reasonable to expect that code like that wouldn't later become vulnerable to injection attacks.

> Yes, my use case was "I always use F-strings" so these other breakages could not occur, by definition.

Unless you're using any dependency at all, including the standard library.

> But.. Python has a history of introducing new features that break old ones.

It doesn't tho.

> That seems to me a balance between backward compatibility and future goodness.

That assumes "everything is an fstring" is considered "future goodness", which I'm not sure is a widely shared view.

> the "from future import auto-fstring" construct could do it...

That seems unlikely as the __future__ pseudo-package has generally been used to opt into hopefully future behaviour.

Given the Python 3 experience, somehow, I don't see "let's make all string literals into fstrings" happen any time soon, but hey feel free to create a PEP proposing that.

Alternatively, create your own import hook which does this swap before handing the module off of to the compiler.

If all strings with what looks like format specs are implicitly f-strings, how do you use reusable template strings, which use the same basic internal syntax, for formatting?

f-strings, like r-strings, have uses, but, like r-strings, I wouldn't want to replace plain strings with them.

Because in some cases it is not desired, if for example the string is used in something that expands it further down the line (think SQL injection potential).
Backwards compatibility for one. Code existed before fstrings that may use curly braces, and you can currently use curly braces in non fstrings without escaping them.

Might also be a performance penalty for always having to run the fstring parser.