Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128754
Precedence: list
MIME-Version: 1.0
References: <CAMU7irLbon_YHUKn01Yy1ks09WO+UkAFXz61EwKw7ROYtMfu3w@mail.gmail.com>
 <BF6CB24D-26D6-4BD8-8193-04841F326984@cschneid.com>
In-Reply-To: <BF6CB24D-26D6-4BD8-8193-04841F326984@cschneid.com>
Date: Wed, 1 Oct 2025 14:19:26 +0200
Message-ID: <CAMU7irKq62Zu2-0K7hxFAqD091K95oFOg06PKqm=e_Waw4LdwQ@mail.gmail.com>
Subject: Re: [PHP-DEV] [DISCUSSION] Validating regex pattern
To: Christian Schneider <cschneid@cschneid.com>
Cc: PHP internals list <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: alex.daubois+php@gmail.com (Alexandre Daubois)

Hi,

> My concern would be that dynamically creating regex patterns has quite a =
lot of possible different foot guns and using something like preg_validate/=
filter_var to prevent warnings seems to not really solve the problem but gi=
ve a false sense of security.

The purpose I see is not to give a sense of security, but to give
quick feedback whether the pattern is valid or not.

> You can end up with a mostly working version which will only trigger the =
fail path later on depending on user input.

I'm not sure to understand the connection here: validating the regex
pattern itself and matching the pattern with something are two
different things.

> It boils down to: If you are not confident that you construct the pattern=
 in a safe way then what would you do if a validation function returns fals=
e? You can notify the developer but that is already accomplished with the p=
reg_* warning when an invalid pattern is given. Creating an error page for =
the user on a warning is also already possible. That's why i'm on the fence=
 whether a validation function does more good or harm.

I don't understand how it could be harmful. Early validation is useful
when it comes to avoiding unnecessary operations if we can already be
sure that it will fail later for obvious reasons. For me, it falls
into the same category as email or URL validation in filter_var.
That's also why I think it would be more appropriate as a flag for
this function rather than a dedicated function.

=E2=80=94 Alexandre Daubois