[Discussion] Introducing str_mask() for partial string masking

Hi everyone, I would like to propose a new native utility function: str_mask(). The Problem: Developers frequently need to mask sensitive information (like phone numbers, email addresses, or token IDs) before displaying them or logging them. Currently, this is achieved in userland using various combinations of substr(), str_repeat(), or preg_replace(). These implementations are often error-prone, especially when dealing with multibyte character encodings. The Proposal: I am suggesting a simple, native helper: str_mask(string $string, int $start, int $length, string $mask_char = '*'): string Why native? Consistency: Providing a reliable, standard way to mask strings across projects. Multibyte Support: Unlike custom userland implementations that might break on non-Latin strings (like Persian/Arabic/CJK), a native implementation can seamlessly handle multibyte characters. Example: // Standard usage (ASCII) echo str_mask("1234567890", 3, 4, "*"); // Output: 123****890 // Multibyte support (UTF-8) echo str_mask("Internalization", 2, 5, "#"); // Output: In#####alization I have a draft implementation ready for review. I would appreciate feedback on whether this utility fits within the scope of the PHP core, or if there are specific concerns regarding such an addition. Best regards, Sepehr