On November 23 of this year, PHP 8.3 is scheduled to be released, bringing with it the much-awaited "json_validate" function. Validating JSON contents is about to get a whole lot better! ❤️🔥
@nunomaduro This is a very odd example you've used there. It doesn't make sense to call json_validate() just to immediately call json_decode(), that's redundant work.
@ramsey@timwolla@nunomaduro AFAIK you may want to actually decode it straight away. But if someone sends a malicious payload the decoding might kill the process by running out of memory because it needs to keep track of everything. Whereas the validate function doesn't have this problem.
The RFC probably highlights this better than my memory.
@Girgias And validation and decoding might be done in 2 separate parts of the application. Then nowadays you will have to do the decode once to see whether it works and then later you are doing the decoding again to get the content...
So an example in a validation context might highlight the improvement better.
@Girgias@ramsey@nunomaduro Nuno's pattern still doesn't protect against than, because one can send a valid JSON string that by definition passes json_validate() and that still takes up too many resources during decoding.
So, either validate or decode, but not both in the same function.
Looking at the reference section of https://wiki.php.net/rfc/json_validate suggest that frameworks are not interested in the performance side of this already. So it might be a small net positive.
Think I'll build a performance advisory for validate+decode on the same payload anyways and see what real world applications do
@edorian@ramsey@timwolla One of my projects receives WebHooks from BIG_CORP, it validates them and tosses them on a queue. (Which while I think about it might not be the best way. Compared to toss on queue up on receiving and dealing with it later.) So validation on getting request, and then decoding once picked up from qeueu is is the current workflow.
Add comment