{"action":"created","issue":{"url":"https://api.github.com/repos/slimphp/Slim/issues/1134","labels_url":"https://api.github.com/repos/slimphp/Slim/issues/1134/labels{/name}","comments_url":"https://api.github.com/repos/slimphp/Slim/issues/1134/comments","events_url":"https://api.github.com/repos/slimphp/Slim/issues/1134/events","html_url":"https://github.com/slimphp/Slim/issues/1134","id":65276931,"number":1134,"title":"Input validation and sanitization middleware","user":{"login":"funkatron","id":1960,"avatar_url":"https://avatars.githubusercontent.com/u/1960?v=3","gravatar_id":"","url":"https://api.github.com/users/funkatron","html_url":"https://github.com/funkatron","followers_url":"https://api.github.com/users/funkatron/followers","following_url":"https://api.github.com/users/funkatron/following{/other_user}","gists_url":"https://api.github.com/users/funkatron/gists{/gist_id}","starred_url":"https://api.github.com/users/funkatron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/funkatron/subscriptions","organizations_url":"https://api.github.com/users/funkatron/orgs","repos_url":"https://api.github.com/users/funkatron/repos","events_url":"https://api.github.com/users/funkatron/events{/privacy}","received_events_url":"https://api.github.com/users/funkatron/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-03-30T18:51:23Z","updated_at":"2015-09-28T15:24:32Z","closed_at":null,"body":"One pain point for me in Slim 2.x was how to do input validation and sanitization. Retrieving values from the request object's `->get()` and `->post()` always return raw, unfiltered data. To turn it into safe(r) data, you need retrieve the items individually or as an array and pass them each through some kind of sanitization functionality, or bypass the request object entirely and do something to the superglobals directly (which may or may not be problematic depending on how Slim is internally handling that data).\r\n\r\nI have a project I've worked on for a long time called [Inspekt](http://funkatron.github.io/inspekt/) that sorta tries to do this to the superglobals. It wraps them inside a \"cage\" object, and you have to use accessor methods to retrieve data. You have to use `getRaw()` to get completely raw, un-sanitized input. The two big wins are, I think:\r\n\r\n1. You're not accessing superglobals directly -- harder to make mistakes\r\n2. You have to *show intent* when getting raw data -- harder to make mistakes\r\n\r\nI think lots of people will have different approaches to how to handle input safely, and I don't think building an opinionated approach into Slim makes sense. However, I do think that it would be good if it was easier to override how request variables are accessed, both on a one-by-one basis, and as an array.\r\n\r\nWere I designing a plugin or add-on for Slim that did this, I would want to be able to:\r\n- eliminate the `request::get()` method entirely\r\n- attach a number of input accessor methods that could either be applied to single values or Arrays (or ArrayObjects).\r\n\r\nI have a few thoughts about how something like this might look API-wise, but I wanted to just get the idea out there first. "},"comment":{"url":"https://api.github.com/repos/slimphp/Slim/issues/comments/143776575","html_url":"https://github.com/slimphp/Slim/issues/1134#issuecomment-143776575","issue_url":"https://api.github.com/repos/slimphp/Slim/issues/1134","id":143776575,"user":{"login":"geggleto","id":4027602,"avatar_url":"https://avatars.githubusercontent.com/u/4027602?v=3","gravatar_id":"","url":"https://api.github.com/users/geggleto","html_url":"https://github.com/geggleto","followers_url":"https://api.github.com/users/geggleto/followers","following_url":"https://api.github.com/users/geggleto/following{/other_user}","gists_url":"https://api.github.com/users/geggleto/gists{/gist_id}","starred_url":"https://api.github.com/users/geggleto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geggleto/subscriptions","organizations_url":"https://api.github.com/users/geggleto/orgs","repos_url":"https://api.github.com/users/geggleto/repos","events_url":"https://api.github.com/users/geggleto/events{/privacy}","received_events_url":"https://api.github.com/users/geggleto/received_events","type":"User","site_admin":false},"created_at":"2015-09-28T15:24:32Z","updated_at":"2015-09-28T15:24:32Z","body":"This is why I kind of wanted Slim to have factories... we could extend the basic RequestFactory to have FilteredRequestFactory which returns a filtered request object"}}