Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118737
MIME-Version: 1.0
References: <CAGBsUrdri=hXQHy5JnVhpiz51FbnqVBHjrBg9-tj8m=vzfZtzA@mail.gmail.com>
 <0cfb9a7b-1168-42ef-ae1a-bdc72210de43@app.fastmail.com> <CA+p1FaaDimmXXxfmGYogENvTpKp2qvyYNt4MyJT9HrehiTbXGg@mail.gmail.com>
 <CAGgaK7LMx+hd_V_EPNnmRb8pggAmP62vVtLjh=xgCFCkCQ0dgw@mail.gmail.com> <CA+p1FaapMaiWzz438Jr7N6B5qg0FecUuzzoe5oce-PyggaSzXw@mail.gmail.com>
In-Reply-To: <CA+p1FaapMaiWzz438Jr7N6B5qg0FecUuzzoe5oce-PyggaSzXw@mail.gmail.com>
Date: Mon, 3 Oct 2022 21:29:53 -0400
Message-ID: <CANYPt=WE+iTbECh3Kzh+jqkkqz2+6ezG6PGpSKypJm0yGQhMCw@mail.gmail.com>
To: David Gebler <davidgebler@gmail.com>
Cc: Max Semenik <maxsem.wiki@gmail.com>, Larry Garfield <larry@garfieldtech.com>, 
	php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000055ebe105ea2b6664"
Subject: Re: [PHP-DEV] Sanitize filters
From: vasilii.b.shpilchin@gmail.com (Vasilii Shpilchin)

--00000000000055ebe105ea2b6664
Content-Type: text/plain; charset="UTF-8"

I believe we are still dIscussing about the sanitizing filters only. No
doubt the filter API in general should be kept in the core as it provides
functional access to input variables with the filter_input() function. The
filter_input() is the only alternative to accessing superglobal arrays
directly. I prefer to use them rather than userland helpers and facades
which may work differently to each other. If you wanted to get back to
superglobal arrays when coding without a framework in PHP 8.3 I won't
believe in that. The set of the sanitizing filters is not perfect, however;
some filters are great and userful:

FILTER_SANITIZE_EMAIL - helps to clean up typical mess caused by
copy-pasting an email.
FILTER_SANITIZE_URI - similar thing but to URIs.
FILTER_SANITIZE_NUMBER_FLOAT - nice since it provides a flag to control
scientific notation (did you know is_float("1e1") is false,
but is_float(1e1), however, you always get a string from input variables,
and there is no other way to handle this case without weird manipulations
on a string).

The purpose of some filters like FILTER_SANITIZE_STRING is difficult to
get, I agree, but the idea to solve common edge-cases with built-in
high-quality functionality is  great, PHP is a language for Web and should
consider web context.



On Mon, Oct 3, 2022 at 8:38 PM David Gebler <davidgebler@gmail.com> wrote:

> On Mon, Oct 3, 2022 at 11:29 AM Max Semenik <maxsem.wiki@gmail.com> wrote:
>
> >
> > Is there a compelling need to have this in the core, as opposed to
> > Composer packages? The ecosystem has changed a lot since the original
> > function was introduced.
> >
>
> I don't know that there is, I suspect the answer is probably not and
> sanitization and validation is probably better left to userland code. The
> only argument I can offer as devil's advocate is that certain validations
> or transformations will be faster in core than in library scripts. I would
> wager the most common implementation of such userland libraries today are
> heavily reliant on preg_* functions so having some fast, low level baseline
> in core for common tasks in this category might still make sense.
>
> While we're on the topic, can I bring up FILTER_SANITIZE_NUMBER_FLOAT? Why
> is the default behaviour of FILTER_SANITIZE_NUMBER_FLOAT the same as
> FILTER_SANITIZE_NUMBER_INT unless you add extra flags to permit fractions?
> Why is the constant name FILTER_SANITIZE_NUMBER_FLOAT but its counterpart
> for validation is FILTER_VALIDATE_FLOAT (no NUMBER_)? Why does validating a
> float return a float but sanitizing a float return a string?
>
> What about FILTER_VALIDATE_EMAIL which is notorious for being next to
> useless?
>
> Seems to me like there could at the very least be a plausible case for some
> better to_float(), to_int(), is_valid_email() etc. type functions in core
> to replace some of the filter API.
>

--00000000000055ebe105ea2b6664--