Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102002
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXafM0QgMdCuUfEnNcejHAi208=4tCqbi1APT20Z_jcvuQ@mail.gmail.com>
References: <CAGa2bXafM0QgMdCuUfEnNcejHAi208=4tCqbi1APT20Z_jcvuQ@mail.gmail.com>
Date: Tue, 27 Mar 2018 18:41:46 +0900
Message-ID: <CAGa2bXaDYg2rMGv_tH2t-=ehvsn_COJoQmX3iVWkxR0=8mf1WQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000057f7e5056861b5c7"
Subject: Re: A validator module for PHP7
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--00000000000057f7e5056861b5c7
Content-Type: text/plain; charset="UTF-8"

On Mon, Sep 4, 2017 at 3:33 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> I spent a little time for a new input validation module. It's not totally
> new module, but is based on Filter module's validation filter improvement
> RFC in many ways. [1]
>
> As all of us knew already, input validation is the most important practice
> in secure coding. [2][3] Yet, we don't provide usable feature out of box.
> Sadly, almost all apps do not have proper input validation at trust
> boundary. Unless we improve filter's validation, we need usable basic
> validator by default. IMO.
>
> Since I didn't get much feedbacks during the RFC discussion, I cannot tell
> what part is disliked. I guess too much features in filter is one reason.
> Another is messed up codes/features by providing both "filter" and
> "validation".
>
> Validator for PHP7 (validate module) gets rid of unneeded features. It
> only has features for basic PHP data type validations. Validation
> rule(spec) array is flexible enough. Almost any types of inputs could be
> handled by multiple and nested validation rules.
>
> Except some minor features like overflow checks, most planned features are
> implemented.
>
> https://github.com/yohgaki/validate-php
>
> Although the code is based on filter module's code, it's almost full
> rewrite except validation logic came from filter. Please consider this as
> under development module.
> Feedbacks are appreciated.
>
> Regards,
>
> [1] https://wiki.php.net/rfc/add_validate_functions_to_filter
> [2] https://www.securecoding.cert.org/confluence/display/
> seccode/Top+10+Secure+Coding+Practices
> [3] https://www.owasp.org/index.php/OWASP_Secure_Coding_
> Practices_-_Quick_Reference_Guide
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>


I thought it would be nice to have PHP script version for
Validate PHP. It a lot easier to modify API as needed. So
I spend few hours last weekend.

https://github.com/yohgaki/validate-php-scr

Caution, I just wrote it and didn't debug it yet.
However, it is good enough to play with, I suppose.

API differs a little. This has more simplified parameter
structure. Suggestions and comments are appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--00000000000057f7e5056861b5c7--