On Tue, Jul 16, 2019 at 5:34 AM Bishop Bettini <bis...@php.net> wrote:

> On Tue, Jul 16, 2019 at 3:51 AM Nikita Popov <nikita....@gmail.com> wrote:
>
> > On Tue, Jul 16, 2019 at 3:40 AM Arnold Daniels <
> > arnold.adaniels...@gmail.com>
> > wrote:
> >
> > > Hi,
> > >
> > > PHP replaces dots with underscores for $_GET, $_POST and $_COOKIE. This
> > > behavior once made sense because of Register globals. The explanation
> in
> > > the manual also still implies that query and post parameters are
> > converted
> > > to variables (see
> > >
> >
> https://php.net/manual/en/language.variables.external.php#language.variables.external.dot-in-names
> > ).
> > > Register globals has been removed since 5.4.0 and thus this behavior
> > serves
> > > little purpose.
> > >
> > > I think it would be good to remove the conversion in PHP 8, as it's a
> > > general cause of confusion and annoyance for anyone who comes across
> it.
> > >
> > > Is there a good reason to keep this behavior in PHP 8?
> > >
> >
> > This has been discussed a few times already, and I think that everyone
> > agrees that this behavior should go, but not necessarily on the migration
> > path. There is an RFC here:
> > https://wiki.php.net/rfc/on_demand_name_mangling
> > I think that the latest version of that RFC, that basically proposes to
> > drop the behavior and tell people to use a polyfill is fine.
> >
>
> I've readied the proposal for formal discussion. As proposed:
>
>    - PHP 8.0 will no longer mangle variable names in any super-global.
>    - The changelog will recommend auditing super-global access for mangled
>    names, and replacing with the actual variable name.
>    - No INI settings will engage the behavior.
>    - No warnings or notices will be emitted.
>    - A polyfill will be made available to emulate that original behavior.
>    - Applications requiring name mangling shall invoke the polyfill during
>    bootstrap phase.
>
> https://wiki.php.net/rfc/on_demand_name_mangling


I think it looks good and well thought-through.  The only thing I'd add is
having the userland polyfill function implementation available/referenced
in the Upgrade notes, so that folks can get it without Composer (in
addition of having it available in Composer).  I suspect the ones who'd
actually won't to use it are quite likely to not be Composer users.

Zeev

Reply via email to