Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114079
MIME-Version: 1.0
References: <CAF+90c9crhPpSMcTx-ozGo0LGjNuBU43e8fiK_=PJMU6iTHNmw@mail.gmail.com>
 <28be190c-21ea-b796-cec7-b8db21d14eca@gmail.com> <CAF+90c8n_Ny5h8JyF6jKc0i4Rg_=msKEa1Eum6rQJmcV2cGQvw@mail.gmail.com>
 <CAH5C8xWEA7ujHWp4DXUMKrepH8ef3efnT5zJ49RVSE1qqkvhGA@mail.gmail.com> <CAF+90c8syP8krO8wMeupfyXmPrZX519LtaxmjLpUjSW0-_Sc=A@mail.gmail.com>
In-Reply-To: <CAF+90c8syP8krO8wMeupfyXmPrZX519LtaxmjLpUjSW0-_Sc=A@mail.gmail.com>
Date: Mon, 19 Apr 2021 22:31:03 +0100
Message-ID: <CAGBsUrc_3R4CZoS8Dcr4c0pHZ+72AV6oS_Sy45TyhnxkYDqLtA@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Cc: Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary="00000000000095ba6f05c05a0cb7"
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 8.1
From: tekiela246@gmail.com (Kamil Tekiela)

--00000000000095ba6f05c05a0cb7
Content-Type: text/plain; charset="UTF-8"

  Hi Nikita,

I would like to propose a deprecation of FILTER_SANITIZE_STRING. This is a
very dubious filter that has almost no use. It removes NUL bytes, encodes
single and double quotes in HTML, and removes anything between < and
optional >. It does not function the same as strip_tags() as pointed out in
this comment
https://www.php.net/manual/en/filter.filters.sanitize.php#118186
It is also one of the only two filters using FILTER_FLAG_NO_ENCODE_QUOTES
flag.
I believe this function is very misleading especially to new users who are
looking for a default string filter. The real default one is
called FILTER_UNSAFE_RAW which sounds like something one should not use.
While in reality, it is FILTER_SANITIZE_STRING that can damage your data
and should not be used.
This also includes the deprecation of FILTER_SANITIZE_STRIPPED which is
just its alias.

Regards,
Kamil

--00000000000095ba6f05c05a0cb7--