Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59023
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.214.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAJzDObfdw=V_Fy0ium9iqKM=U-9qVmCXfsZdb3Hdn34Zwk246g@mail.gmail.com>
References: <CAJWj5+EwBpeMV__6SN7NbzQ0y4=RDGyg_HueU4N4AZz3Kb=CRQ@mail.gmail.com>
	<CADyq6sL2zbnqcYLpc7UrctPqdK+5TYztytKCxjdVUqUidsRN2g@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B806A48BEC0C@MAILR001.mail.lan>
	<CAJWj5+Eg5h7p=o5JRxw8gsRsT_LGGadMbNUqx5RxzRPif6u+Dw@mail.gmail.com>
	<CAJWj5+EfPh7oFq3NRH8iDSwU8kzhYQQfWByrbNHZO5dFdDQWGQ@mail.gmail.com>
	<CAJzDObfdw=V_Fy0ium9iqKM=U-9qVmCXfsZdb3Hdn34Zwk246g@mail.gmail.com>
Date: Mon, 19 Mar 2012 00:11:13 +0100
Message-ID: <CAJWj5+HSGK80EDzBN2EW9teWf7xVS2gMwQFvMJSgWGmEgkKSJw@mail.gmail.com>
To: Adam Jon Richardson <adamjonr@gmail.com>
Cc: PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Scalar-type-hinting - which way is the best to go?
From: simonsimcity@googlemail.com (Simon Schick)

2012/3/18 Adam Jon Richardson <adamjonr@gmail.com>:
> On Sun, Mar 18, 2012 at 7:12 AM, Simon Schick
> <simonsimcity@googlemail.com>wrote:
>
>>
>> Hi, All
>>
>> Just to add an example why I want a more strictly type-check here as
>> we have in the current type-juggling:
>>
>> http://www.brandonsavage.net/an-xss-vulerability-in-the-making/?utm_source=rss&utm_medium=rss&utm_campaign=an-xss-vulerability-in-the-making
>
>
> I see the example given as one of poor validation, not a reason for more
> strict type checking in a dynamic, weakly typed language.
>
> One could:
>
> - use a regex
> - setting the third argument (strict comparison) of in_array() to true -OR-
> looping through the array and checking equivalence with ===
> - ensure the type juggled value (the integer form) was returned and used
> rather than using the original string
>
> I actually like the conversation on scalar type hinting, and I've even
> offered some ideas for integrating a form of it, too. However, poor input
> validation is not one of the reasons that I would use to justify its
> inclusion. The goal of proper input validation should be to account for
> page requests that include invalid data and provide appropriate feedback
> within the natural flow of the application. Erring out when calling a more
> strongly typed function at runtime does not provide this type of
> application flow.
>
> Adam

Hi, Adam

I totally agree that type-hinting should not cover what the programmer
should do for validating the given input ...
But I just wanted to point out that this is something the author (and
I) would never expect to happen ...

in_array("123abc", array(3, 7, 123, 28)) === true

But that's another thing :)
I just wanted to point out that I don't want to have the string
"123abc" accepted as an integer :)

Anyways ... This thread should be a discussion about the whole
concept, not the details.
Sorry for getting off-context here.

Bye
Simon