Skip to content

Stdlib: filter_input() request-input snapshot vs live $_GET (#19640) - #19650

Merged
PurHur merged 1 commit into
masterfrom
agent/stdlib-filter-input-snapshot-19640
Jul 16, 2026
Merged

PurHur merged 1 commit into
masterfrom
agent/stdlib-filter-input-snapshot-19640

Conversation

@PurHur

@PurHur PurHur commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • Capture request-input snapshots when CGI populates $_GET / $_POST / $_COOKIE (php-src IF_G semantics).
  • filter_input() / filter_has_var() / filter_input_array() read the snapshot, not live mutable superglobals — CLI empty request → NULL; CGI query still works after $_GET[...] = writes.
  • Umbrella JITTest skips the new mutation cases (MCJIT still reads live sg_*; VM is php-src-strict).

php-src: ext/filter/filter.c — php_filter_get_input

Test plan

  • CLI repro: NULL / NULL / false on VM
  • QUERY_STRING=x=42 → 42 then still 42 after $_GET['x']='99'
  • VM compliance: request snapshot + CGI immutable + filter_batch_api

Verification

php bin/vm.php test/repro/issue_19640_filter_input_cli_snapshot.php
QUERY_STRING=x=42 php bin/vm.php -r '...'
php -d memory_limit=512M vendor/bin/phpunit --filter "filter_input_request_snapshot|filter_input_cgi_snapshot_immutable|filter_batch_api" test/compliance/VMTest.php

Closes #19640

Made with Cursor

Capture IF_G-style copies when CGI populates \$_GET/\$_POST/\$_COOKIE so
filter_input/filter_has_var/filter_input_array ignore later superglobal
writes. CLI with empty request tables returns NULL like Zend.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Regression: filter_input(INPUT_GET) follows runtime $_GET writes — Zend CLI NULL (re-#4404, ext/filter/filter.c)

1 participant