RE: Concerns about Zend_Filter_Input

Hi Ed,

Actually, the implementations of Zend_Filter and Zend_Filter_Input in earlier preview releases of Zend Framework have been _replaced_ by a much better object-oriented class design that provides similar functionality.  It’s better because it also serves as an extensible framework for developers to implement custom filters and validators.  And also, an application needs to load only the filters and validators that it needs, instead of a monolithic class that contains all filters and validators.

You can see the proposal that described this change here:

http://framework.zend.com/wiki/x/Wi8

You can see the documentation for the new Zend_Filter and Zend_Validate classes here:

http://framework.zend.com/manual/en/zend.filter.html

http://framework.zend.com/manual/en/zend.validate.html

Neither the old classes nor the new classes force the developer to access input data through filters.  Usage of these classes is encouraged, but it is up to the developer to utilize them.  Both in the old design and in the new design, it is possible to write PHP applications that access inputs such as superglobals directly, without the enforcement of any filtering.

The goal has always been to promote safe programming practices and reduce risks of security issues in application code, by providing classes that help developers filter out malicious content using a simple object-oriented API.  But we don’t want to constrain developers to a single solution.

There is still more work to do, to make the process of filtering and validation even easier to use. We’ll enhance the solution in future versions of Zend Framework after 1.0.  For example, we intend to design an easy-to-use component to apply filtering/validation logic against aggregations of web input data.

Regards,

Bill Karwin