Chris Meller wrote:
> The SuperGlobals implementation is novel and sounds great in theory, but
> hasn't stood up in practice. Having an object instead of a true array
> has made numerous things more difficult, especially if you're writing
> code that expects normal $_* arrays. In the end, it tries so hard to
> behave like the native $_* arrays, but falls just short enough that
> it'll easily drive you into madness.
I'm interested in concrete examples of the classes being used in a
correct way that can't be corrected in the class. So for example,
empty($_POST) is invalid, whereas count($_POST) is.
Nonetheless:
> In order to use any of our pseudo-arrays as actual arrays, you have to
> remember to use ->getArrayCopy() or ->get_array_copy_raw(). That's
> annoying... and it hurts my fingers. It also doesn't let you use it in
> conditions such as if ( empty( $_POST->getArrayCopy() ) ) because you
> can't use a method return value in a write context. Setting a temporary
> variable to the result array and testing against that is a waste of code
> and time.
This seems easily fixed by adding count() and empty() methods to
SuperGlobal, creating $_POST->count() or $_POST->empty() which are much
more readable:
if($_POST->empty()) {...}
It also doesn't trigger the copy of the array, and doesn't need to
intimate the intricacies of SPL (via getArrayCopy) to the novice coder.
> And just when you think I'm going to complain and run, here's another
> suggested approach, based a lot on the CodeIgniter and (more so) Kohana
> frameworks' implementations:
The reason we've avoided this approach is to implement security in a
good way, abiding by the rule "Make it easier to do the right thing by
default". The Input::foo() functions in other frameworks don't make it
easier to do the right thing.
Although the idea may seem more concrete, it's just a different way of
doing input filtering that people would need to learn and (more
importantly) also apply correctly. It's probably a greater learning
curve than switching from count($_POST) to $_POST->count(), simply
because until you try to do something silly like count the number of
post submissions, you'd never encounter the problem.
On the other hand, you'd likely be using input values all the time and
would need to evaluate, as most devs simply don't know how to do,
whether a value should be filtered or not. Using the SuperGlobal class
as-is makes the default choice easy for those who don't look any deeper,
and yet provides the required additional power to those who do.
Owen
--~--~---------~--~----~------------~-------~--~----~
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/habari-dev
-~----------~----~----~----~------~----~------~--~---
