Re: Packages accessing super globals

Ian P. Christian wrote:

I recently sparked off a conversation on irc://efnet/#pear about packages accessing _POST/_GET/_SESSION directly. I think that PEAR should provide a central system to abstract these calls, so all packages would do something like PEAR::getGet('action'); PEAR::getPost('username'); etc. etc. It should be possible for people to somehow override this system too, so rather then using the built in PEAR getPost and getGet functions, a custom class/set of functions could be registered. The same should happen for _SESSIONs. Your thoughts?

The only place I see this being useful is a built-in language feature for security reasons. Fortunately, PHP5 has been actively exploring this option, as shown on the animated php-internals list. Input filters can be enabled in either php.ini or programmatically to strip tags and other nasties from all $_SUPERGLOBALS via an extension that will be in pecl (and not enabled by default) Greg