Re: [rfc] str_mask function

Why is this needed in php itself? Masking seems very use-case specific and would be better done inside php library with extensible modules for different types of data to mask. Ilia Alshanetsky Technologist, CTO, Entrepreneur E: ilia@ilia.ws T: @iliaa B: http://ilia.ws On Fri, Sep 18, 2026, 2:29 p.m. سپهر محمودی <sepehrphpr@gmail.com> wrote: > Hi everyone, > > I'm officially starting my work on the ext/intl and standard string > functions, and I'm very excited to share my first major proposal for PHP > 8.7! > > I have successfully set up my local development environment and compiler > on my machine, and everything is up and running smoothly. > > As part of this, I would like to propose a new native function called > str_mask(). > > ### Proposal Overview > The str_mask() function is designed to securely mask portions of a string > using a specified mask character. This is extremely useful for handling > sensitive user data like credit card numbers, phone numbers, and tokens. > > Signature: > str_mask(string $string, string $mask_char = '*', int $offset = 0, ?int > $length = null): string > > ### Examples > 1. Masking a credit card (positive offset & length): > $credit_card = '1234567890123456'; > $masked_card = str_mask($credit_card, '*', 4, 8); > // Output: 1234********3456 > > 2. Masking a phone number (negative offset to count from the end): > $phone_number = '+989123456789'; > $masked_phone = str_mask($phone_number, 'X', -4); > // Output: +9891234XXXX > > You can find all the details, implementation plans, and RFC discussions > here: > https://wiki.php.net/rfc/str_mask > > Looking forward to hearing your feedback and thoughts! > > Best regards, > Sepehr Mahmoudi > >