Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:47836
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pooteeweet.org from 188.40.37.16 cause and error)
Mime-Version: 1.0 (Apple Message framework v1078)
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <g2ie69760ac1004080348je15d757flcb4b034b99423ec6@mail.gmail.com>
Date: Thu, 8 Apr 2010 12:51:16 +0200
Cc: internals@lists.php.net
Content-Transfer-Encoding: 7bit
Message-ID: <65CA45D8-4D33-412E-AD72-BD592B074E8B@pooteeweet.org>
References: <g2ie69760ac1004080348je15d757flcb4b034b99423ec6@mail.gmail.com>
To: daniel zulla <daniel.zulla@googlemail.com>
Subject: Re: [PHP-DEV] User Input Callback as a new security feature
From: mls@pooteeweet.org (Lukas Kahwe Smith)


On 08.04.2010, at 12:48, daniel zulla wrote:

> Hi,
> Take a look at the code example [1].
> Why not giving programmers the possibility to init their scripts with
> a call, that tells exactly what data should be taken - like GET userid
> INT and GET password MIXED, or just POST domainid INT, or something
> like that.
> 
> If there's data transmitted, the scripts doesn't need, why should we
> go on with execution?
> 
> In my example, request_init would check if there is $_POST['userid'],
> $_POST['pass'], $_GET['userid'] or $_GET['pass'] and if userid is an
> integer, and pass is mixed.
> 
> If that's all right, the script just goes on working.
> If not, and that's the clue, the callback function will be called,
> telling the user what's wrong.
> 
> A feature like that would highly improve security. Programmers
> wouldn't even think about stupid solutions like getting all the $_POST
> data into an Array() and trying to quote it anymore. It's an advantage
> for readability too:
> You take a look on the code, and you just know exactly what's going on.
> 
> When magic_quotes and register_globals will, finally, be killed in
> PHP6, this could be, finally, a real security feature, couldn't it?
> 
> Greets,
> Daniel Zulla
> 
> [1] Code Example:
> <?php
>    request_init(Array(POST, GET), Array(userid => INT, pass =>
> mixed), $callback->crap_transmitted, 1);
> ?>
> <html>


are you aware of the filter extension:
http://php.net/filter

regards,
Lukas Kahwe Smith
mls@pooteeweet.org