Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118736
MIME-Version: 1.0
References: <CAGBsUrdri=hXQHy5JnVhpiz51FbnqVBHjrBg9-tj8m=vzfZtzA@mail.gmail.com>
 <0cfb9a7b-1168-42ef-ae1a-bdc72210de43@app.fastmail.com> <CA+p1FaaDimmXXxfmGYogENvTpKp2qvyYNt4MyJT9HrehiTbXGg@mail.gmail.com>
 <CAGgaK7LMx+hd_V_EPNnmRb8pggAmP62vVtLjh=xgCFCkCQ0dgw@mail.gmail.com>
In-Reply-To: <CAGgaK7LMx+hd_V_EPNnmRb8pggAmP62vVtLjh=xgCFCkCQ0dgw@mail.gmail.com>
Date: Tue, 4 Oct 2022 01:38:22 +0100
Message-ID: <CA+p1FaapMaiWzz438Jr7N6B5qg0FecUuzzoe5oce-PyggaSzXw@mail.gmail.com>
To: Max Semenik <maxsem.wiki@gmail.com>
Cc: Larry Garfield <larry@garfieldtech.com>, php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000000d3b3605ea2aaef7"
Subject: Re: [PHP-DEV] Sanitize filters
From: davidgebler@gmail.com (David Gebler)

--0000000000000d3b3605ea2aaef7
Content-Type: text/plain; charset="UTF-8"

On Mon, Oct 3, 2022 at 11:29 AM Max Semenik <maxsem.wiki@gmail.com> wrote:

>
> Is there a compelling need to have this in the core, as opposed to
> Composer packages? The ecosystem has changed a lot since the original
> function was introduced.
>

I don't know that there is, I suspect the answer is probably not and
sanitization and validation is probably better left to userland code. The
only argument I can offer as devil's advocate is that certain validations
or transformations will be faster in core than in library scripts. I would
wager the most common implementation of such userland libraries today are
heavily reliant on preg_* functions so having some fast, low level baseline
in core for common tasks in this category might still make sense.

While we're on the topic, can I bring up FILTER_SANITIZE_NUMBER_FLOAT? Why
is the default behaviour of FILTER_SANITIZE_NUMBER_FLOAT the same as
FILTER_SANITIZE_NUMBER_INT unless you add extra flags to permit fractions?
Why is the constant name FILTER_SANITIZE_NUMBER_FLOAT but its counterpart
for validation is FILTER_VALIDATE_FLOAT (no NUMBER_)? Why does validating a
float return a float but sanitizing a float return a string?

What about FILTER_VALIDATE_EMAIL which is notorious for being next to
useless?

Seems to me like there could at the very least be a plausible case for some
better to_float(), to_int(), is_valid_email() etc. type functions in core
to replace some of the filter API.

--0000000000000d3b3605ea2aaef7--