Question

When i write down a function is a good practice to validate all the parameters of the function like this:

<?php
/**
 * foo - Test function
 *
 * @param int $paramA
 * @param str $paramB
 * @param array $paramC
 *
 * @return something
 */
function foo($paramA, $paramB, $paramC) {
    // verify all parameters
    if(!is_int($paramA)) {
        return 0; // or error msg
    }
    if(!is_string($paramB)) {
        return 1; // or error msg
    }
    if(!is_array($paramC)) {
        return 2; // or error msg
    }

    // some code in function scope that uses parameters 
    // and saves the results in $result
    return $result;
}

or should i rely on the user that will use the function and assume that he knows what he is doing and forget about parameter validation?

Personally i prefer to validate all the parameter of the function and return error codes for consistency of the code and make my life easier afterwords.

Thank you in advance.

Answer 1

If it is an internal function that only you will be using, it is probably okay to not validate every single parameter like that. If it is a function that has parameters that depend on user input (for example, you get information through $_GET, and then pass that to a function), then it needs to be validated.

Never rely on a user or anyone else besides yourself to know what they are doing. Sometimes it can be helpful to validate things like this if you are writing code that you can re-use later (like if you were writing your own framework to use across all of your PHP projects). But if it is just one application-specific function that only you can call with parameters that only you define, I wouldn’t worry about it.