Use explicit mixed for global array variables

[herndlm]

Refs: phpstan/phpstan#7450

well, let's see how much this will break..

[ondrejmirtes]

Definitely needs to be a bleedingEdge tag :) Don't forget to update LazyScopeFactory + DirectScopeFactory.

[ondrejmirtes]

Perfect, thank you!

[gnutix]

Hey there. Just a question @herndlm :

I try to explain to colleagues that we should handle this type-safe

How exactly do you do that in this scenario ? Storing the value of the global array you want to use into a variable and using @var on the variable, or doing is_*() (string, numeric, ...) kind of checks on the value of the global array before using it ?

[ondrejmirtes]

Developers should never use @var, especially not on an untrusted user input 😊

The right approach now is cuyz/valinor, or azjezz/psl.

[herndlm]

How exactly do you do that in this scenario ? Storing the value of the global array you want to use into a variable and using @var on the variable, or doing is_*() (string, numeric, ...) kind of checks on the value of the global array before using it ?

yeah, basically just https://phpstan.org/writing-php-code/narrowing-types. We just had some simple primitive type fields/vars from $_POST, just as the playground-snippet from the linked discussion.

for more complex array shapes I would definitely also try to use what Ondrej suggested in the previous comment. Never used those libs, but they are on my list :)