Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112976
To: "internals@lists.php.net" <internals@lists.php.net>
Thread-Topic: Proposal: Move filter_var() to core, leaving filter_input*() in
 the 'filter' module
Thread-Index: AQHW8psmnj9EPU+Tckio3ckznCYwVg==
Date: Sun, 24 Jan 2021 22:51:00 +0000
Message-ID:
 <DM6PR07MB6618F7D3A3F8DBEDE3A76C7BF9BE9@DM6PR07MB6618.namprd07.prod.outlook.com>
Accept-Language: en-CA, en-US
Content-Language: en-CA
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 834f59f8-71a6-434a-e6c4-08d8c0ba8595
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jan 2021 22:51:00.9769
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2NAM02HT091
Subject: Proposal: Move filter_var() to core, leaving filter_input*() in the
 'filter' module
From: tysonandre775@hotmail.com (tyson andre)

Hi internals,=0A=
=0A=
The filter_var functionality is one of the most efficient and well-known wa=
ys in PHP to validate and sanitize inputs for many use cases=0A=
(e.g. FILTER_VALIDATE_INT for checking if a string is well-formed decimal i=
nput (or other bases),=0A=
FILTER_VALIDATE_BOOL for user input/configs (cli/server api), FILTER_VALIDA=
TE_URL, FILTER_VALIDATE_EMAIL).=0A=
=0A=
The filter_var functionality is something that you can disable with --disab=
le-filter, and I've often encountered code with=0A=
a few dependencies or source files that assume that filter_var is always av=
ailable when building php from source.=0A=
=0A=
```=0A=
# Composer version 2.0.4 2020-10-30 22:39:11=0A=
sapi/cli/php ~/bin/composer.phar=0A=
Fatal error: Uncaught Error: Call to undefined function JsonSchema\Uri\filt=
er_var() in phar:///path/to/bin/composer.phar/vendor/justinrainbow/json-sch=
ema/src/JsonSchema/Uri/UriResolver.php=0A=
# public function resolve($uri, $baseUri =3D null)=0A=
# {=0A=
#     if (!is_null($baseUri) && !filter_var($baseUri, \FILTER_VALIDATE_URL)=
 && ....=0A=
```=0A=
=0A=
For me, the main reason why a developer/admin/hosting provider may want to =
disable the 'filter' module is=0A=
=0A=
1. The filter_input() functionalities that allow direct access to the origi=
nal POST/GET/COOKIE/ENV data.=0A=
    e.g. this makes code harder to test if the code or third party librarie=
s it=0A=
    uses harder to unit test because $_GET/$_POST/$_COOKIE/$_ENV can't be r=
eplaced in filter_input.=0A=
2. The php build steps may have been carried over from PHP 5.2 when 'filter=
' was brand new and much less code used filter.=0A=
3. Desire for slightly smaller installations=0A=
4. Unaware of it since phpxyz-core and phpxyz-filter are different modules =
in an OS's package manager=0A=
=0A=
The filters themselves(https://www.php.net/manual/en/filter.constants.php) =
seem to be free of side effects=0A=
glancing at the descriptions and implementation.=0A=
=0A=
The fact that filter_var isn't enabled by default may lead to=0A=
=0A=
1. Application/library authors unconditionally using intval()/floatval() or=
 other functions in core that don't check for unexpected suffixes (e.g. '10=
MB')=0A=
   Many languages have a function like atoi() that detects invalid integers=
=0A=
2. Applications skipping filtering steps if the function filter_var doesn't=
 exist, e.g. allowing any string to be used as a url/email=0A=
3. Dependencies failing to run due to throwing Errors on rare configuration=
s where filter_var is unavailable.=0A=
=0A=
It seems like filter is useful enough to already be statically compiled int=
o the Windows builds published on windows.php.net=0A=
=0A=
-----=0A=
=0A=
What are your thoughts on the following:=0A=
=0A=
Move the following functions into core and statically build them:=0A=
(and all global `FILTER_*` constants but not `INPUT_*` from https://www.php=
.net/manual/en/filter.constants.php)=0A=
=0A=
- filter_has_var =97 Checks if variable of specified type exists=0A=
- filter_id =97 Returns the filter ID belonging to a named filter=0A=
- filter_list =97 Returns a list of all supported filters=0A=
- filter_var_array =97 Gets multiple variables and optionally filters them=
=0A=
- filter_var =97 Filters a variable with a specified filter=0A=
=0A=
Keep the following remaining functions in the 'filter' extension, continue =
enabling them by default and allowing --disable-filter to disable them:=0A=
=0A=
- filter_input_array =97 Gets external variables and optionally filters the=
m=0A=
- filter_input =97 Gets a specific external variable by name and optionally=
 filters it=0A=
=0A=
Thanks,=0A=
- Tyson=