Am 26.08.2026 um 17:15 schrieb [email protected]: > I am not proposing that PHP accept more characters -- it already accepts > everything. I am proposing a per-file declare under which the accepted > set is specified: well-formed UTF-8, UAX31-R1-2 with the standard > Default-Ignorable Exclusion Profile, and NFC required rather than > applied. Identifiers consisting only of bytes below 0x80 are never > examined, so existing code pays nothing.
What problem would this restriction solve? Is it about an code smuggling attack vector using code obfuscation with indistinguishable Unicode sequences? > The patch would not touch the re2c scanner: the byte rule is already > maximally permissive and cannot split a UTF-8 sequence, so a strict > mode only ever rejects and the check can run after the token is formed. > About 13.7 KiB of generated tables, with no dependency on intl, ICU or > mbstring. I would write and maintain it. > > Is this worth an RFC, or is there an objection I should know about > before I spend the time? Not sure if I think it is worth the effort but maybe you can shine some light on why we want this. I'm currently leaning to -1 on this, - Chris
