Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94899
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZh1BP48oM+AHzB9Yb4r5+B+W8WDOU-KEsVe+N4KHza4g@mail.gmail.com>
References: <CAGa2bXa8Oj=xi6ZUKYFe5XXuhZvOL6JT=31QHoq8EG-9veGDBg@mail.gmail.com>
 <nnu4fj$cul$1@blaine.gmane.org> <CAGa2bXZrtf1jy_W4Dzs72mxs9kmXx5586jbagjHRop3uzcuFYA@mail.gmail.com>
 <nnv8rf$24e$1@blaine.gmane.org> <CAGa2bXZh1BP48oM+AHzB9Yb4r5+B+W8WDOU-KEsVe+N4KHza4g@mail.gmail.com>
Date: Sun, 7 Aug 2016 19:20:56 +0700
Message-ID: <CAEZPtU5UAc7d++kjPa3YFUN6w=p=73tyHrG8WGLfsJXXMWg2Gw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: PHP internals <internals@lists.php.net>, Christian Stadler <stadli@gmx.de>
Content-Type: multipart/alternative; boundary=001a113d31c204744105397a5518
Subject: Re: [PHP-DEV] Adding validate_var_array()/validate_input_array() to
 which version?
From: pierre.php@gmail.com (Pierre Joye)

--001a113d31c204744105397a5518
Content-Type: text/plain; charset=UTF-8

On Aug 5, 2016 2:30 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>
> Hi Christian,
>
> On Thu, Aug 4, 2016 at 8:27 PM, Christian Stadler <stadli@gmx.de> wrote:
> > Am 04.08.2016 um 12:10 schrieb Yasuo Ohgaki:
> >> Hi Christian and all,
> >>
> >> On Thu, Aug 4, 2016 at 10:07 AM, Christian Stadler <stadli@gmx.de>
wrote:
> >>> Am 01.08.2016 um 10:23 schrieb Yasuo Ohgaki:
> >>>> P.S. It's possible to return array that contains offending values. It
> >>>> is not included since users can store whole offending input array.
> >>>> Whole input is more useful for attack analysis.
> >>> Actually I wanted to suggest exactly that for ppl. who want to give
> >>> Feedback to their users, what values failed to validate to the users.
> >>> Probably with a fourth optional param, like `$return_invalid = false`?
> >>> Of course logging is a different topic and should always use the whole
> >>> offending input array.
> >> I can set offending value to filter globals so that it can be
> >> retrieved later in catch block. I cannot return or modify referenced
> >> parameter because of raised exception.
> >
> > Well, since some people have objections about raising exceptions here,
> > this should probably be either in a seperate vote or additional options
> > in the main vote. Probably something, like:
> > Yes, either | Yes, without the exception | Yes, with the exception | No
> > Personally I would vote for 'Yes, either'. If I could, that is.
>
> One of my objective is following best practices.
> Prefer exception over error is one of them. Although, I strongly suggest
> to use exception for validation errors, I will have choices.

I see them as conditions flow not errors per se but flow.

Invalid options could raise exceptions but it brings inconcistencies with
the other filter functions.

I feel like this rfc needs more discussions and maybe we will add more
things to filter as well.

But anything proposed is already possible very easily in userland. I would
not rush it into 7.1.

--001a113d31c204744105397a5518--