My stance: Uninitialized variables and array keys are fine. Back-end security issues with setting them should be fixed in core, not worked around by banning them.
Please, convince me that uninitialized variables are wrong. I WANT TO BELIEVE!
@e3betht@phptek Default values should be provided in a single location. Undefined values means extra error handling for every potential read. Forcing a variable to be defined with a reasonable default simplifies all code that may read that variable.
@Crell@phptek Are you saying that you can trust a value if it has been previously defined? I could agree with that if it is defined in the same script and you are absolutely confident that line of code will be run, but otherwise, if you are truly being careful, I'm not sure you can trust it. Especially if it comes from a session, a library, or any other external source.
@e3betht@phptek It's only relevant within the scope of one function/method. Within that, you should be able to control that all variables are defined and initialized.
The exception is object or array arguments. Which is why you should not pass arrays as data structures, and use fully typed objects that have constructors that make sure everything is initialized.
Then you can be certain a value is defined and has a legal value.
Add comment