Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79063
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <5A250A28-F5C2-4FF1-B144-C19B2220EADC@ajf.me>
References: <D7C8CEF6-625E-4489-8EFC-8FCAA16302D2@ajf.me> <CAFMT4NodhUcS3f-nnCpxGuR=AA6-g9wTchzeS7faTeu9SSL5xw@mail.gmail.com>
 <CADajX4Ctcn7HHu_YbxunT1TALbx8Koe1F4pOO_YwjKv5n8=Vgg@mail.gmail.com> <5A250A28-F5C2-4FF1-B144-C19B2220EADC@ajf.me>
Date: Fri, 21 Nov 2014 12:13:47 +0900
Message-ID: <CAGa2bXbGE0q5+87i+1MoDHcu5oVZ6TJCVnjC3qgZBLoF6526wg@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: Adam Harvey <aharvey@php.net>, Levi Morrison <levim@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=90e6ba6e84cac12844050855d756
Subject: Re: [PHP-DEV] [VOTE][RFC] Safe Casting Functions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--90e6ba6e84cac12844050855d756
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Andrea,

On Fri, Nov 21, 2014 at 11:06 AM, Andrea Faulds <ajf@ajf.me> wrote:

> Ideally, usage of these functions should be accompanied by some sort of
> validation logic if necessary for the application. They aren=E2=80=99t va=
lidation
> functions in themselves, they just prevent certain conversions that don=
=E2=80=99t
> make sense. Say someone fails to do proper validation and does this:
>
>     $user =3D User::get((int)$_GET[=E2=80=98id=E2=80=99]);
>
> With this code, absolutely anything could be passed for =E2=80=9Cid=E2=80=
=9D in the URL
> parameter and it=E2=80=99d be converted to a valid integer, transforming =
garbage
> into apparently valid values.
>
> On the other hand, say they did this:
>
>     $user =3D User::get(to_int($_GET[=E2=80=98id=E2=80=99]));
>
> If I pass something that is not a number (like =E2=80=9Cfoobar=E2=80=9D),=
 it would throw
> an exception.
>

This is good use case. IMHO.
PHP should provide easy API by default for more secure application.
Parameters sent from client are validated on client with modern web apps.
There are number of cases that validating as int/etc is enough.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--90e6ba6e84cac12844050855d756--