Add true validation functions validate_var_array() and input_input_array()

[yohgaki]

See RFC for more details and updates.

RFC: https://wiki.php.net/rfc/add_validate_functions_to_filter

filter_var_array()/filter_input_array() return value is hard to tell if there were validation errors because they simply filter inputs. i.e. They set FALSE or NULL for invalid elements and return filtered array. This behavior makes it difficult to use filter_array()/filter_input_array() as validation functions that reject invalid inputs.

This patch adds true validation functions

• filter_require_var_array() - Almost the same as filter_var_array() except it raise UnexpectedValueException on validation failure(s), instead of filtered array and does not add NULL for non-existing elements by default.
• filter_require_input_array(), validate_var() and validate_input(). The same as above.
• filter_check_definition() - Checks definition array for validate___array() and filter___array(). Since definition errors are ignored silently. This function is mandatory for security reasons. i.e. Filter module could fallback to weakest option.

String validation filter

• String validation filter is added.
• UTF-8 encoding is supported only and used by default.
• FILTER_STRING_ENCODING_PASS should be used for binary and other encodings.

Invalid validation filter

• Internally, there is code assumes invalid filter existence, but it didn't exist.

Note on callback filter

• No callback for validation filter is added.
• Users must raise UnexpectedValueException when there is invalid data.

Multiple sanitize/validation filter.

• Allows multiple filters and filter options by array of filters/options.
• Older implementation ignored such spec silently.

e.g.

    <?php
    error_reporting(E_ALL | E_STRICT);
    );

    $args = array(
        'component'    =>
        array(
                // New filter module allows multiple filters and options as follows.
                // Array elements are evaluated in order. Non array spec is evaluated last.
                // Older implementation ignores this kind of spec silently.
                array(
                        'filter'    => FILTER_VALIDATE_INT,
                        'options'   => array('min_range' => 1, 'max_range' => 10)
                ),
                array(
                        'filter' => FILTER_VALIDATE_REGEXP,
                        'options' => array('regexp' => '/[0123456789]{2}/')
                ),
                array(
                        'filter' => FILTER_VALIDATE_FLOAT
                ),
        ),
    );

    // Throws UnexpectedValueException for invalid inputs.
    try {
        $myinputs = validate_var_array($data, $args);
        var_dump($myinputs); // NOTE: If you need returned array value, it MUST be inside try block.
    } catch (UnexpectedValueException $e) {
        var_dump($e->getMessage());
    }

[staabm]

missing /* }}} */

[yohgaki]

Thanks! Fixed.

[staabm]

when is a array considered invalid? (and why?)

[yohgaki]

I updated the patch. It is considered invalid as soon as a validation rule fails now.

[KalleZ]

I think this should be named FILTER_FLAG_STRING_ALLOW_CTRL (without the 'n' in the end), as well as the userland constant as the constant name is already fairly long, and because CTRL is a more common abbreviation of control than CNTRL

[yohgaki]

No problem for me. The reason CNTRL is used is this API.

• int iscntrl(int c);

I have mixed feeling. We have following

http://php.net/manual/en/intlchar.iscntrl.php
http://php.net/manual/en/function.ctype-cntrl.php

Any comments on using CTRL? Anyone?

[KalleZ]

Gonna close this due to inactivity, please open a new PR if you decide to pick up on it and post an RFC