Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94835
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <nnv8rf$24e$1@blaine.gmane.org>
References: <CAGa2bXa8Oj=xi6ZUKYFe5XXuhZvOL6JT=31QHoq8EG-9veGDBg@mail.gmail.com>
 <nnu4fj$cul$1@blaine.gmane.org> <CAGa2bXZrtf1jy_W4Dzs72mxs9kmXx5586jbagjHRop3uzcuFYA@mail.gmail.com>
 <nnv8rf$24e$1@blaine.gmane.org>
Date: Fri, 5 Aug 2016 04:29:21 +0900
Message-ID: <CAGa2bXZh1BP48oM+AHzB9Yb4r5+B+W8WDOU-KEsVe+N4KHza4g@mail.gmail.com>
To: Christian Stadler <stadli@gmx.de>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Adding validate_var_array()/validate_input_array() to
 which version?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Christian,

On Thu, Aug 4, 2016 at 8:27 PM, Christian Stadler <stadli@gmx.de> wrote:
> Am 04.08.2016 um 12:10 schrieb Yasuo Ohgaki:
>> Hi Christian and all,
>>
>> On Thu, Aug 4, 2016 at 10:07 AM, Christian Stadler <stadli@gmx.de> wrote:
>>> Am 01.08.2016 um 10:23 schrieb Yasuo Ohgaki:
>>>> P.S. It's possible to return array that contains offending values. It
>>>> is not included since users can store whole offending input array.
>>>> Whole input is more useful for attack analysis.
>>> Actually I wanted to suggest exactly that for ppl. who want to give
>>> Feedback to their users, what values failed to validate to the users.
>>> Probably with a fourth optional param, like `$return_invalid = false`?
>>> Of course logging is a different topic and should always use the whole
>>> offending input array.
>> I can set offending value to filter globals so that it can be
>> retrieved later in catch block. I cannot return or modify referenced
>> parameter because of raised exception.
>
> Well, since some people have objections about raising exceptions here,
> this should probably be either in a seperate vote or additional options
> in the main vote. Probably something, like:
> Yes, either | Yes, without the exception | Yes, with the exception | No
> Personally I would vote for 'Yes, either'. If I could, that is.

One of my objective is following best practices.
Prefer exception over error is one of them. Although, I strongly suggest
to use exception for validation errors, I will have choices.

(Exception should be used error cases that should not happen usually,
but usual error handling would work. Error message could be more user
friendly because php_error_docref() supports va arg)

>
>> I don't mind adding this feature. It requires an API like
>> validate_get_offending_value(). (The name should be nicer)
>> How many of us are interested in this feature?
>
> Then this new function should have an offset param. With this I could
> check, if the array has any offending values and then continue with the
> rest ... mmh, now that I think of it, this isn't really necessary.
>
> Uhm, well anyway: I'd suggest, that the ind(ex/ices) should be returned
> rather, than the actual value names.

OK. Thank you.
I'll add this. The reason why I said store "value" is the code.
To get index, it has to store index somewhere or change many lines of code.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net