Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94904
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.216.169 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <CANUQDChyL9irik2W4LtGLDCbsYnPQMT8_5Ye-h9u2Tt+-k-vdQ@mail.gmail.com>
References: <CAGa2bXa8Oj=xi6ZUKYFe5XXuhZvOL6JT=31QHoq8EG-9veGDBg@mail.gmail.com>
 <nnu4fj$cul$1@blaine.gmane.org> <CAGa2bXZrtf1jy_W4Dzs72mxs9kmXx5586jbagjHRop3uzcuFYA@mail.gmail.com>
 <nnv8rf$24e$1@blaine.gmane.org> <CAGa2bXZh1BP48oM+AHzB9Yb4r5+B+W8WDOU-KEsVe+N4KHza4g@mail.gmail.com>
 <CAEZPtU5UAc7d++kjPa3YFUN6w=p=73tyHrG8WGLfsJXXMWg2Gw@mail.gmail.com> <CANUQDChyL9irik2W4LtGLDCbsYnPQMT8_5Ye-h9u2Tt+-k-vdQ@mail.gmail.com>
Date: Sun, 7 Aug 2016 14:46:21 -0700
Message-ID: <CANaX5neui2676eww=r2-hGGmP-CRsJERp4VQzowBQrZOj1VGyA@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Pierre Joye <pierre.php@gmail.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	PHP internals <internals@lists.php.net>, Christian Stadler <stadli@gmx.de>
Content-Type: multipart/alternative; boundary=001a11350a52ffc73a0539823a2e
Subject: Re: [PHP-DEV] Adding validate_var_array()/validate_input_array() to
 which version?
From: davey@php.net (Davey Shafik)

--001a11350a52ffc73a0539823a2e
Content-Type: text/plain; charset=UTF-8

On Sun, Aug 7, 2016 at 8:20 AM, Niklas Keller <me@kelunik.com> wrote:

> 2016-08-07 14:20 GMT+02:00 Pierre Joye <pierre.php@gmail.com>:
>
> > On Aug 5, 2016 2:30 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
> > >
> > > Hi Christian,
> > >
> > > On Thu, Aug 4, 2016 at 8:27 PM, Christian Stadler <stadli@gmx.de>
> wrote:
> > > > Am 04.08.2016 um 12:10 schrieb Yasuo Ohgaki:
> > > >> Hi Christian and all,
> > > >>
> > > >> On Thu, Aug 4, 2016 at 10:07 AM, Christian Stadler <stadli@gmx.de>
> > wrote:
> > > >>> Am 01.08.2016 um 10:23 schrieb Yasuo Ohgaki:
> > > >>>> P.S. It's possible to return array that contains offending values.
> > It
> > > >>>> is not included since users can store whole offending input array.
> > > >>>> Whole input is more useful for attack analysis.
> > > >>> Actually I wanted to suggest exactly that for ppl. who want to give
> > > >>> Feedback to their users, what values failed to validate to the
> users.
> > > >>> Probably with a fourth optional param, like `$return_invalid =
> > false`?
> > > >>> Of course logging is a different topic and should always use the
> > whole
> > > >>> offending input array.
> > > >> I can set offending value to filter globals so that it can be
> > > >> retrieved later in catch block. I cannot return or modify referenced
> > > >> parameter because of raised exception.
> > > >
> > > > Well, since some people have objections about raising exceptions
> here,
> > > > this should probably be either in a seperate vote or additional
> options
> > > > in the main vote. Probably something, like:
> > > > Yes, either | Yes, without the exception | Yes, with the exception |
> No
> > > > Personally I would vote for 'Yes, either'. If I could, that is.
> > >
> > > One of my objective is following best practices.
> > > Prefer exception over error is one of them. Although, I strongly
> suggest
> > > to use exception for validation errors, I will have choices.
> >
> > I see them as conditions flow not errors per se but flow.
> >
> > Invalid options could raise exceptions but it brings inconcistencies with
> > the other filter functions.
> >
> > I feel like this rfc needs more discussions and maybe we will add more
> > things to filter as well.
> >
> > But anything proposed is already possible very easily in userland. I
> would
> > not rush it into 7.1.
> >
>
> Isn't it a bit late to target 7.1 anyway?
>

Yes, it is much too late for 7.1, this will have to be targeted towards 7.2+

- Davey

--001a11350a52ffc73a0539823a2e--