Globals, closures, and filter_input

From: Date: Mon, 19 May 2014 20:00:22 +0000
Subject: Globals, closures, and filter_input
Groups: php.internals 
Request: Send a blank email to internals+get-74369@lists.php.net to get a copy of this message
This seems to me to be an odd combination and it is not explictly documented. I'm running under PHP 5.5.12 First off, when after executing unset($_GET) - the global $_GET variable no longer exists. However, calling filter_input(INPUT_GET,...) continues to return data from the query string. So filter_input and filter_has_var are independent of the $_GET variable. IE they will return whatever the original data was. This is noted in the comments regarding these functions, http://us1.php.net/manual/en/function.filter-input.php - I simply want to double check that this is working as designed, and not a bug that will be corrected[since there is no spec for this feature. :-)] Moreover, it is possible to bind a closure to a global variable, for example: https://gist.github.com/garyamort/c656846ba3969c492d20 In this code, I bind a closure which returns the results of filter_input(INPUT_GET,...) to the $_GET super global. This was simply a quick and dirty exercise dynamically enabling $_GET variable filtering in a manner which integrates nicely with most introductory PHP tutorials. A more thorough solution would be to instead create an ArrayObject subclass and map the various array methods to the appropriate filter_input and filter_has_var functions. In that way, 'legacy' code could have it's input automatically sanitized, with the ability to change the type of sanitization which occurs during execution[since the current default sanitzation ini setting can not be changed dynamically] However, global variables are not supposed to be bound to closures and objects, then this could result in future problems if that feature is ever modified.

« previous php.internals (#74369) next »