Re: Stop replacing dots with underscores in query, post and cookie parameters for PHP 8?
| From: | Nikita Popov | Date: | Tue, 16 Jul 2019 18:39:03 +0000 |
| Subject: | Re: Stop replacing dots with underscores in query, post and cookie parameters for PHP 8? | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-106223@lists.php.net to get a copy of this message | ||
On Tue, Jul 16, 2019 at 2:34 PM Bishop Bettini <bishop@php.net> wrote:
> On Tue, Jul 16, 2019 at 3:51 AM Nikita Popov <nikita.ppv@gmail.com> wrote:
>
> > On Tue, Jul 16, 2019 at 3:40 AM Arnold Daniels <
> > arnold.adaniels.nl@gmail.com>
> > wrote:
> >
> > > Hi,
> > >
> > > PHP replaces dots with underscores for $_GET, $_POST and $_COOKIE. This
> > > behavior once made sense because of Register globals. The explanation
> in
> > > the manual also still implies that query and post parameters are
> > converted
> > > to variables (see
> > >
> >
>
> https://php.net/manual/en/language.variables.external.php#language.variables.external.dot-in-names
> > ).
> > > Register globals has been removed since 5.4.0 and thus this behavior
> > serves
> > > little purpose.
> > >
> > > I think it would be good to remove the conversion in PHP 8, as it's a
> > > general cause of confusion and annoyance for anyone who comes across
> it.
> > >
> > > Is there a good reason to keep this behavior in PHP 8?
> > >
> >
> > This has been discussed a few times already, and I think that everyone
> > agrees that this behavior should go, but not necessarily on the migration
> > path. There is an RFC here:
> > https://wiki.php.net/rfc/on_demand_name_mangling
> > I think that the latest version of that RFC, that basically proposes to
> > drop the behavior and tell people to use a polyfill is fine.
> >
>
> I've readied the proposal for formal discussion. As proposed:
>
> - PHP 8.0 will no longer mangle variable names in any super-global.
> - The changelog will recommend auditing super-global access for mangled
> names, and replacing with the actual variable name.
> - No INI settings will engage the behavior.
> - No warnings or notices will be emitted.
> - A polyfill will be made available to emulate that original behavior.
> - Applications requiring name mangling shall invoke the polyfill during
> bootstrap phase.
>
> https://wiki.php.net/rfc/on_demand_name_mangling
Can you please start a new [RFC] thread for this?
Nikita