Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98964
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF1yvASd4S9AFUhX7HYyJ8qH76b6EQCSALJEzV+uD5xyx9ym8w@mail.gmail.com>
References: <CAF1yvARPJnxBecX5e-dd4Bb5qQ4MqMxYg0Rv7cNf94Rs+i8m2Q@mail.gmail.com>
 <0b4f249f-f574-2dcc-4485-1d765bc4cb18@gmail.com> <CAF1yvASd4S9AFUhX7HYyJ8qH76b6EQCSALJEzV+uD5xyx9ym8w@mail.gmail.com>
Date: Thu, 4 May 2017 08:51:23 -0400
Message-ID: <CAEUnE0c+8sOvqfzo2Vg4MwHduXWDP+gwLx-Yc2ZtHJi=oW1aeA@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f40304361ce8f87f26054eb23a65
Subject: Re: [PHP-DEV] Add is_vectorlike($array) function
From: tendoaki@gmail.com (Michael Morris)

--f40304361ce8f87f26054eb23a65
Content-Type: text/plain; charset=UTF-8

For what it's worth, the Drupal assertion inspector calls these "Strict
Arrays" since that's what they are - arrays in the true sense of the term
found in all other languages. What PHP is calling an "array" is more
accurately a "map" or "hash"

There is value in this validation - https://www.drupal.org/SA-CORE-2014-005
relied on the attacker providing an sql injection where the code was
expecting numeric keys.

There's no easy solution - this is just one of those things where PHP is
painted into a corner by backwards compatibility. Calling them vectors just
seems weird though.  Calling them strict arrays at a language level has its
own problems.

On Thu, May 4, 2017 at 7:23 AM, Jesse Schalken <me@jesseschalken.com> wrote:

> On Tue, May 2, 2017 at 7:55 PM, Rowan Collins <rowan.collins@gmail.com>
> wrote:
>
> > +1, I've been thinking of making a similar suggestion. We can bikeshed
> the
> > name (it should certainly start with "array_"), but I think there's a
> very
> > good case for having an optimised implementation built in, given the
> > opportunities for short-cutting based on representation details.
> >
>
> Something like array_is_vectorlike(), array_is_vector() or
> array_is_sequential() sound good to me. You could also do the opposite,
> array_is_assoc().
>
> As an example use case, serialization formats often dynamically switch
> > between an "array"/"vector"/"list", and a "hash"/"dictionary"/"table". I
> > came upon this example recently: https://github.com/php-amqplib
> > /php-amqplib/blob/master/PhpAmqpLib/Wire/AMQPAbstractCollection.php#L218
>
>
> Another reason this function would be of utility is that it would
> discourage even more inefficient implementations that allocate new arrays,
> like the one in that code ("array_keys($val) === range(0, count($val) -
> 1)"), and nearly every single answer to this StackOverflow question (except
> mine):
> https://stackoverflow.com/questions/173400/how-to-check-
> if-php-array-is-associative-or-sequential/
>

--f40304361ce8f87f26054eb23a65--