Add FILTER_FLAG_NO_SCIENTIFIC to FILTER_VALIDATE_FLOAT GH-9311

[KapitanOczywisty]

This allows to validate floats, without allowing scientific format. Existing flag FILTER_FLAG_ALLOW_SCIENTIFIC is not used, since we don't want to change default behavior - scientific allowed. FILTER_FLAG_DISALLOW_SCIENTIFIC was proposed, but _NO_ is more consistent with other flags and the way filter_var works.

Fixes: #9311

/cc @8ctopus

[cmb69]

The feature looks reasonable, and the implementation is okay (although I'm slightly concerned regarding the flag depletion), but besides that this needs to be discussed on the internals mailing list, it is not clear whether this could target PHP-8.2 at all, although I'd consider this a small self-contained change. @ramsey, @saundefined, @adoy, thoughts about this?

[KapitanOczywisty]

although I'm slightly concerned regarding the flag depletion

When this became a problem, flags can reuse numbers, when they are not able to be used in the same filter.

it is not clear whether this could target PHP-8.2 at all

In worst case It will wait for 8.3.

this needs to be discussed on the internals mailing list

@8ctopus can you contact internals mailing list with this proposition?

[adoy]

@cmb69 I agree with you that this is a small change. I'm OK to include this change in 8.2 if discussion on internals don't raise any flags that I don't see.

[8ctopus]

sorry for the slowness, I'm trying to get up and running with the mailing list subscription but without luck so far (wrote an email to the admin)

[saundefined]

@8ctopus I started a discussion.

Can you explain what the error you got? Perhaps, we also can help you :)

[remicollet]

FILTER_FLAG_ALLOW_SCIENTIFIC, FILTER_FLAG_ALLOW_FRACTION and FILTER_FLAG_ALLOW_THOUSAND are only used in FILTER_SANITIZE_NUMBER_FLOAT case.

Perhaps will be simpler to:

• change default flags for filter_var to use FILTER_FLAG_ALLOW_SCIENTIFIC + FILTER_FLAG_ALLOW_FRACTION + FILTER_FLAG_ALLOW_THOUSAND (thus keep BC)
• check 3 options in php_filter_float (consistency between VALIDATE / SANITIZE filter)

so you can use

• filter_var($foo, FILTER_VALIDATE_FLOAT); default flags, same behavior, no BC
• filter_var($foo, FILTER_VALIDATE_FLOAT, FILTER_FLAG_ALLOW_FRACTION); to disable scientific

[KapitanOczywisty]

@remicollet filter_var($foo, FILTER_VALIDATE_FLOAT, FILTER_FLAG_ALLOW_THOUSAND); Wouldn't that be a BC? After change scientific wouldn't be allowed, and in fact fraction too. No other validator have any flags enabled by default, so changing that for on of them I feel is a bad idea.

[remicollet]

@KapitanOczywisty read my previous comment... about default flags and BC

[KapitanOczywisty]

@remicollet I read your comment... That's why I'm mentioning BC. Ok, so let me show better example (more popular):

filter_var("0.1", FILTER_VALIDATE_FLOAT, FILTER_NULL_ON_FAILURE) now it returns float(0.1)

• change default flags for filter_var to use FILTER_FLAG_ALLOW_SCIENTIFIC + FILTER_FLAG_ALLOW_FRACTION + FILTER_FLAG_ALLOW_THOUSAND (thus keep BC)

With that, above code would return NULL, thus no Backward Compatibility. What I'm missing in your comment? Default flags do not change anything when FILTER_NULL_ON_FAILURE is present.

Edit:

FILTER_FLAG_ALLOW_SCIENTIFIC, FILTER_FLAG_ALLOW_FRACTION and FILTER_FLAG_ALLOW_THOUSAND are only used in FILTER_SANITIZE_NUMBER_FLOAT case.

FILTER_FLAG_ALLOW_THOUSAND is used already in FILTER_VALIDATE_FLOAT and is disabled by default.

• change default flags for filter_var to use FILTER_FLAG_ALLOW_SCIENTIFIC + FILTER_FLAG_ALLOW_FRACTION + FILTER_FLAG_ALLOW_THOUSAND (thus keep BC)

Thus FILTER_FLAG_ALLOW_SCIENTIFIC | FILTER_FLAG_ALLOW_FRACTION should be the default in that concept.

[KapitanOczywisty]

There is no interest to merge this, so closing.

[8ctopus]

Sorry for the time waisted :(