Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:14479
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <420005A3.8050605@lerdorf.com>
Date: Tue, 01 Feb 2005 14:41:39 -0800
User-Agent: Mozilla Thunderbird 1.0 (Macintosh/20041206)
MIME-Version: 1.0
To: Andi Gutmans <andi@zend.com>
CC: internals@lists.php.net
References: <5.1.0.14.2.20050201111730.0299da70@localhost> <5.1.0.14.2.20050201111730.0299da70@localhost> <5.1.0.14.2.20050201142816.026d21c0@localhost>
In-Reply-To: <5.1.0.14.2.20050201142816.026d21c0@localhost>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 5.1
From: rasmus@lerdorf.com (Rasmus Lerdorf)

Andi Gutmans wrote:
> As time is very short, I suggest to discuss exactly what we want and 
> then to see if it's possible in a 5.1 time frame.
> Can you give a short overview of what you had in mind and how the 
> end-user would be using the functionality?

Well, I am not starting from scratch here.  I have code, it just needs a 
bit of polishing.

But the general idea is to provide an optional filter that people can 
enable in their ini file.  This will strip out any XSS, quotes, braces, 
etc.  The actual list will need to be massaged a bit, and there will be 
multiple filters so people can choose how strict to be by default.

At the same time a filter access function is provided.

eg.

$age  = pfilter(POST, 'age', FILTER_DIGITS);
$addr = pfilter(POST, 'addr', FILTER_ALNUM);
$body = pfilter(REQUEST, 'body', FILTER_TAGS);
$raw  = pfilter(COOKIE,'cook', FILTER_RAW);

We obviously can't turn on the input filter by default, but even without 
the default filter enabled, providing a set of input filters for people 
to use so they don't have to come up with complicated regular 
expressions to check user input will go a long way to make it easier for 
people to write safer applications.  Even people who actually take the 
step to do input validation tend to get the validation wrong as we have 
seen in a number of recent examples.

-Rasmus