Globals, closures, and filter_input
| From: | Gary Mort | Date: | Mon, 19 May 2014 20:00:22 +0000 |
| Subject: | Globals, closures, and filter_input | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-74369@lists.php.net to get a copy of this message | ||
This seems to me to be an odd combination and it is not explictly documented.
I'm running under PHP 5.5.12
First off, when after executing unset($_GET) - the global $_GET variable no longer exists. However, calling filter_input(INPUT_GET,...) continues to return data from the query string.
So filter_input and filter_has_var are independent of the $_GET variable. IE they will return whatever the original data was. This is noted in the comments regarding these functions, http://us1.php.net/manual/en/function.filter-input.php - I simply want to double check that this is working as designed, and not a bug that will be corrected[since there is no spec for this feature. :-)]
Moreover, it is possible to bind a closure to a global variable, for example:
https://gist.github.com/garyamort/c656846ba3969c492d20
In this code, I bind a closure which returns the results of filter_input(INPUT_GET,...) to the $_GET super global.
This was simply a quick and dirty exercise dynamically enabling $_GET variable filtering in a manner which integrates nicely with most introductory PHP tutorials.
A more thorough solution would be to instead create an ArrayObject subclass and map the various array methods to the appropriate filter_input and filter_has_var functions.
In that way, 'legacy' code could have it's input automatically sanitized, with the ability to change the type of sanitization which occurs during execution[since the current default sanitzation ini setting can not be changed dynamically]
However, global variables are not supposed to be bound to closures and objects, then this could result in future problems if that feature is ever modified.