Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78204
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CA+9eiLs9j0XMbtNKSSuqTBhF-BEc1CU__3E4gOhYwuF5zF4_1g@mail.gmail.com>
References: <66B7B28C-2651-4A71-AC2A-55D4C7BB3DDC@ajf.me>
	<CA+9eiLs9j0XMbtNKSSuqTBhF-BEc1CU__3E4gOhYwuF5zF4_1g@mail.gmail.com>
Date: Tue, 21 Oct 2014 18:57:00 +0400
Message-ID: <CAEbg-4bPujOnpfq+MoigeU2RmjG2JGHU=dUS=wZU=_F=fv+vpw@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Safe Casting Functions
From: lisachenko.it@gmail.com (Alexander Lisachenko)

Hello, internals!

> Good evening,
>
> I am presenting a new RFC to add a set of three functions to do validated casts for scalar types:
>
> https://wiki.php.net/rfc/safe_cast
>
> Please read it.

Personally I don't like this RFC because it's introducing one more way
to cast value in PHP. We already have boolval(), intval(), strlva()
functions that are not widely used in the source code, because of
dynamic nature of PHP. Developers just use value as is, assuming that
it will cast automatically where needed. This kind of casting is
typically used to prevent an attacks like this $id =
intval($_GET['id']); But this is ugly implementation from my point of
view. Binding and sanitization can do this much better.

There is also one more way to cast values with explicit casting: $id =
(int) $_GET['id']. I think that this way of doing casting is more
natural for developers to read, because many languages use the same
scheme to cast values into another types. Instead of implementing new
to_xxxx() functions, it can be nice to reuse logic of casting with
"(type) $value" to follow
https://wiki.php.net/rfc/scalar_type_hinting_with_cast#conversion_rules
which looks great.

Besides this, there is casting with settype($value, $type) and one
more with filter sanitization.

If this RFC will be accepted there will be one more way with own logic
of casting. And this is not so good from userland point of view.

It can be good only with OOP support for primitive types, for example
$value = '1234'; $number = $value->toInt(); $float =
$value->toFloat(), etc..

Thanks!