Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:108635
Date: Mon, 17 Feb 2020 07:51:26 +0000
User-Agent: K-9 Mail for Android
In-Reply-To: <F8A96229-5D9C-4DF2-9A76-F65517177FA0@newclarity.net>
References: <50BD013E-CF72-414C-BBC0-A7A2E45CBDDB@pmjones.io> <5DEE5A6E-2587-432D-9651-320DF42A7732@newclarity.net> <A988787C-9EB6-4BF2-90DF-68F0D3BAC494@pmjones.io> <DC294D91-AA70-45C4-A3A5-32454675F42A@newclarity.net> <D3BABA50-AE6A-4711-A595-878CA8A8175F@pmjones.io> <C0EED521-5C75-40F0-9723-2B6D5FFA799E@newclarity.net> <52c24f76-570a-8541-1d62-555f2a0582f5@gmail.com> <F8A96229-5D9C-4DF2-9A76-F65517177FA0@newclarity.net>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
CC: internals@lists.php.net
Message-ID: <1215E82A-FEFD-4379-A1A1-7F9C8B920251@gmail.com>
Subject: Re: [PHP-DEV] RFC: Server-Side Request and Response Objects (v2)
From: rowan.collins@gmail.com (Rowan Tommins)

On 17 February 2020 00:45:26 GMT+00:00, Mike Schinkel <mike@newclarity=2Ene=
t> wrote:
>I think your latter points are orthogonal to this=2E  And that you are
>taking my advocacy for adding filtering to apply too literally to only
>the specific implementations in filter_input()=2E

Firstly, I deliberately didn't say "the filter API isn't well designed", I=
 said "designing a good validation API is hard"=2E In particular, finding t=
he balance between flexibility and simplicity is key=2E

Including a single blessed validation API in something as fundamental as a=
 request object should take a lot of careful design, not be an afterthought=
 to something like the current RFC=2E


I also talked specifically about moving away from the old assumptions of C=
GI=2E What does it mean to "filter" a JSON body? We could check it's valid =
JSON, but parsing it will reveal that anyway=2E We could automatically pars=
e it in the request object, and have "filters" apply to individual elements=
; but where would the user supply parser options, and how would you specify=
 nested elements?

Or we could keep it as a dumb string, and leave the validation to other sy=
stems, like a JSON Schema validator=2E

Even with a plain HTML form, you might be using a form builder and want to=
 associate your validation with the form definition rather than having it b=
aked into the request object=2E



>But given how much work it is get to an RFC over the line, it feels
>like decoupling would end up with a lot more work, lengthen the
>timeline to achieve base level functionality, and add uncertainty to
>whether it will even happen whereas handling the 20% now that we need
>80% of the time would mean the API would be mostly fully usable out of
>the gate=2E

Funny, I see the exact opposite: trying to build a single set of classes w=
hich include a system for getting global state AND a system for parsing it =
in different ways AND an in-built validation API seems like a mammoth task=
=2E And if you keep it monolithic, any feature you miss or make a mistake o=
n is much harder to fix later=2E

Regards,

--=20
Rowan Tommins
[IMSoP]