Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128753
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Precedence: list
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.100.1.1.5\))
Subject: Re: [PHP-DEV] [DISCUSSION] Validating regex pattern
Date: Wed, 1 Oct 2025 13:05:22 +0200
References: <CAMU7irLbon_YHUKn01Yy1ks09WO+UkAFXz61EwKw7ROYtMfu3w@mail.gmail.com>
To: PHP internals list <internals@lists.php.net>
In-Reply-To: <CAMU7irLbon_YHUKn01Yy1ks09WO+UkAFXz61EwKw7ROYtMfu3w@mail.gmail.com>
Message-ID: <BF6CB24D-26D6-4BD8-8193-04841F326984@cschneid.com>
From: cschneid@cschneid.com (Christian Schneider)

Am 01.10.2025 um 11:01 schrieb Alexandre Daubois =
<alex.daubois+php@gmail.com>:
> There is currently no way of knowing if a regex pattern is valid, =
apart from writing clunky code. [2]
>=20
> Two propositions emerged from the issue: either create a dedicated =
"preg_validate()" function, or add a new flag to "filter_var()", namely =
FILTER_VALIDATE_REGEX_PATTERN.

My concern would be that dynamically creating regex patterns has quite a =
lot of possible different foot guns and using something like =
preg_validate/filter_var to prevent warnings seems to not really solve =
the problem but give a false sense of security.
You can end up with a mostly working version which will only trigger the =
fail path later on depending on user input.

It boils down to: If you are not confident that you construct the =
pattern in a safe way then what would you do if a validation function =
returns false? You can notify the developer but that is already =
accomplished with the preg_* warning when an invalid pattern is given. =
Creating an error page for the user on a warning is also already =
possible. That's why i'm on the fence whether a validation function does =
more good or harm.

Regards,
- Chris