Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128765
Precedence: list
MIME-Version: 1.0
References: <CAMU7irLbon_YHUKn01Yy1ks09WO+UkAFXz61EwKw7ROYtMfu3w@mail.gmail.com>
 <BF6CB24D-26D6-4BD8-8193-04841F326984@cschneid.com> <CAMU7irKq62Zu2-0K7hxFAqD091K95oFOg06PKqm=e_Waw4LdwQ@mail.gmail.com>
In-Reply-To: <CAMU7irKq62Zu2-0K7hxFAqD091K95oFOg06PKqm=e_Waw4LdwQ@mail.gmail.com>
Date: Thu, 2 Oct 2025 01:12:19 +0300
Message-ID: <CAPhkiZwh_w3-WnhjvLJPe1qTKZ9+jkVC==VxsQVCEuUOBG2DYw@mail.gmail.com>
Subject: Re: [PHP-DEV] [DISCUSSION] Validating regex pattern
To: Alexandre Daubois <alex.daubois+php@gmail.com>
Cc: Christian Schneider <cschneid@cschneid.com>, PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000001870180640202af2"
From: narf@devilix.net (Andrey Andreev)

--0000000000001870180640202af2
Content-Type: text/plain; charset="UTF-8"

On Wed, Oct 1, 2025, 15:22 Alexandre Daubois <alex.daubois+php@gmail.com>
wrote:

>
> > It boils down to: If you are not confident that you construct the
> pattern in a safe way then what would you do if a validation function
> returns false? You can notify the developer but that is already
> accomplished with the preg_* warning when an invalid pattern is given.
> Creating an error page for the user on a warning is also already possible.
> That's why i'm on the fence whether a validation function does more good or
> harm.
>
> I don't understand how it could be harmful. Early validation is useful
> when it comes to avoiding unnecessary operations if we can already be
> sure that it will fail later for obvious reasons. For me, it falls
> into the same category as email or URL validation in filter_var.
> That's also why I think it would be more appropriate as a flag for
> this function rather than a dedicated function.
>

Emails and URLs are commonly expected end user inputs. Regular expressions
are not, and that is almost always a bad idea.
A bad idea which would be encouraged by making it easy to implement.

I am generally in favor of adding niche functionality, but this one does
worry me.

Cheers,
Andrey.

--0000000000001870180640202af2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><br><div class=3D"gmail_quote gmail_quote_container"=
><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Oct 1, 2025, 15:22 Alexandre=
 Daubois &lt;<a href=3D"mailto:alex.daubois%2Bphp@gmail.com">alex.daubois+p=
hp@gmail.com</a>&gt; wrote:</div><blockquote class=3D"gmail_quote" style=3D=
"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
&gt; It boils down to: If you are not confident that you construct the patt=
ern in a safe way then what would you do if a validation function returns f=
alse? You can notify the developer but that is already accomplished with th=
e preg_* warning when an invalid pattern is given. Creating an error page f=
or the user on a warning is also already possible. That&#39;s why i&#39;m o=
n the fence whether a validation function does more good or harm.<br>
<br>
I don&#39;t understand how it could be harmful. Early validation is useful<=
br>
when it comes to avoiding unnecessary operations if we can already be<br>
sure that it will fail later for obvious reasons. For me, it falls<br>
into the same category as email or URL validation in filter_var.<br>
That&#39;s also why I think it would be more appropriate as a flag for<br>
this function rather than a dedicated function.<br></blockquote></div></div=
><div dir=3D"auto"><br></div><div dir=3D"auto">Emails and URLs are commonly=
 expected end user inputs. Regular expressions are not, and that is almost =
always a bad idea.</div><div dir=3D"auto">A bad idea which would be encoura=
ged by making it easy to implement.</div><div dir=3D"auto"><br></div><div d=
ir=3D"auto">I am generally in favor of adding niche functionality, but this=
 one does worry me.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Chee=
rs,</div><div dir=3D"auto">Andrey.</div><div dir=3D"auto"><br></div><div di=
r=3D"auto"><div class=3D"gmail_quote gmail_quote_container"><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex">
</blockquote></div></div></div>

--0000000000001870180640202af2--