Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74369
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.44 as permitted sender)
Message-ID: <537A62D6.6050704@gmail.com>
Date: Mon, 19 May 2014 16:00:22 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Globals, closures, and filter_input
From: garyamort@gmail.com (Gary Mort)

This seems to me to be an odd combination and it is not explictly 
documented.

I'm running under PHP 5.5.12

First off, when after executing unset($_GET) - the global $_GET variable 
no longer exists.  However, calling filter_input(INPUT_GET,...) 
continues to return data from the query string.

So filter_input and filter_has_var are independent of the $_GET 
variable.  IE they will return whatever the original data was.  This is 
noted in the comments regarding these functions, 
http://us1.php.net/manual/en/function.filter-input.php  - I simply want 
to double check that this is working as designed, and not a bug that 
will be corrected[since there is no spec for this feature. :-)]

Moreover, it is possible to bind a closure to a global variable, for 
example:

https://gist.github.com/garyamort/c656846ba3969c492d20

In this code, I bind a closure which returns the results of 
filter_input(INPUT_GET,...) to the $_GET super global.

This was simply a quick and dirty exercise dynamically enabling $_GET 
variable filtering in a manner which integrates nicely with most 
introductory PHP tutorials.

A more thorough solution would be to instead create an ArrayObject 
subclass and map the various array methods to the appropriate 
filter_input and filter_has_var functions.

In that way, 'legacy' code could have it's input automatically 
sanitized, with the ability to change the type of sanitization which 
occurs during execution[since the current default sanitzation ini 
setting can not be changed dynamically]

However, global variables are not supposed to be bound to closures and 
objects, then this could result in future problems if that feature is 
ever modified.