Re: Deprecate filter_input() or not?

On Wed, Feb 5, 2025, at 14:13, Christoph M. Becker wrote: > Hi all! > > There is some discussion on a recent bug report[1] about filter_input() > and related functionality. The bug report had been closed, because this > functionality has already been added to the general deprecation RFC for > PHP 8.5[2]. Then the OP raised a point regarding the usefulness of > filter_input() to get at the original input, to avoid working with > possibly modified superglobals. > > In my opinion, this topic should be discussed here, and not in a bug > report. So, has anybody thoughts about the filter_input() deprecation? > > [1] <https://github.com/php/php-src/issues/17543> > [2] > > <https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_filter_input_filter_input_array_and_filter_has_var> > > Christoph > Hey Christoph, I don’t know why they are focusing on WordPress specifically, but this function is vital for any software that runs untrusted code (plugins, anything exec’d from /tmp — ie, templates, compiled containers, etc). Gina suggests using psr7 which suffers from the same problem in most frameworks, which allow setting a new request object or mutating it in some way. I’m not sure it should be deprecated and I’d even argue not closing tickets just because they are in the mass-deprecation rfc that hasn’t been voted on yet. — Rob