For what it's worth, the Drupal assertion inspector calls these "Strict
Arrays" since that's what they are - arrays in the true sense of the term
found in all other languages. What PHP is calling an "array" is more
accurately a "map" or "hash"

There is value in this validation - https://www.drupal.org/SA-CORE-2014-005
relied on the attacker providing an sql injection where the code was
expecting numeric keys.

There's no easy solution - this is just one of those things where PHP is
painted into a corner by backwards compatibility. Calling them vectors just
seems weird though.  Calling them strict arrays at a language level has its
own problems.

On Thu, May 4, 2017 at 7:23 AM, Jesse Schalken <m...@jesseschalken.com> wrote:

> On Tue, May 2, 2017 at 7:55 PM, Rowan Collins <rowan.coll...@gmail.com>
> wrote:
>
> > +1, I've been thinking of making a similar suggestion. We can bikeshed
> the
> > name (it should certainly start with "array_"), but I think there's a
> very
> > good case for having an optimised implementation built in, given the
> > opportunities for short-cutting based on representation details.
> >
>
> Something like array_is_vectorlike(), array_is_vector() or
> array_is_sequential() sound good to me. You could also do the opposite,
> array_is_assoc().
>
> As an example use case, serialization formats often dynamically switch
> > between an "array"/"vector"/"list", and a "hash"/"dictionary"/"table". I
> > came upon this example recently: https://github.com/php-amqplib
> > /php-amqplib/blob/master/PhpAmqpLib/Wire/AMQPAbstractCollection.php#L218
>
>
> Another reason this function would be of utility is that it would
> discourage even more inefficient implementations that allocate new arrays,
> like the one in that code ("array_keys($val) === range(0, count($val) -
> 1)"), and nearly every single answer to this StackOverflow question (except
> mine):
> https://stackoverflow.com/questions/173400/how-to-check-
> if-php-array-is-associative-or-sequential/
>

Reply via email to