Input Laravel Package

Getting Started

Start by installing the package via Composer:

composer require joomla/input

The core class is Joomla\Input\Input, which abstracts $_GET, $_POST, and $_REQUEST. Create an instance and immediately use it:

use Joomla\Input\Input;

$input = new Input(); // reads $_REQUEST by default
$name = $input->get('name'); // uses default "cmd" filter
$id = $input->getInt('id'); // shorthand for integer filtering

For Laravel integration, inject Input\Input via constructor into services/controllers. Its first use case is replacing direct superglobal access (e.g., $_POST['foo']) with a testable, filter-aware abstraction.

Implementation Patterns

• Dependency Injection: Inject Input\Input (or specific subclasses like Input\Files) into classes that need request data. This enables easy unit testing with mocks and avoids tight coupling to global state.

• Request Method Switching:

  if ($input->getMethod() === 'POST') {
      $data = $input->get('data', [], 'array'); // validate POST payload
  }
  

• Sub-Superglobal Access via Magic Getters:

  $user = $input->server->get('HTTP_USER_AGENT'); // reads $_SERVER
  $host = $input->env->get('APP_ENV');             // reads $_ENV
  $csrf = $input->cookie->get('token');            // reads $_COOKIE
  

• JSON API Handling: Use Input\Json for modern APIs:

  $jsonInput = new Joomla\Input\Json();
  $payload = $jsonInput->get('user'); // parses JSON body
  

• File Uploads: Use Input\Files for structured access to $_FILES:

  $files = new Joomla\Input\Files();
  $avatar = $files->get('avatar'); // returns normalized array, not PHP’s nested structure
  

• Filter Customization: Pass a custom InputFilter instance during construction to tweak filtering rules globally.

Gotchas and Tips

• Filter Defaults: Omitting a filter in get() results in aggressive sanitization (HTML stripped, trimmed). For raw input (e.g., Markdown content), explicitly use 'raw' filter.

• Magic Get Not Universal: Not all magic getters like $input->foo map to filters. Only known ones (getInt, getWord, etc.) are pre-wired. Unknown ones fallback to getString.

• Null Data Sources: Passing null as the data array in the constructor uses the current superglobal snapshot. For testing, inject static arrays instead.

• Serialization Safety: Input removes SERVER and ENV on serialize. Avoid relying on them after unserialization—even within the same request.

• Laravel Specific Tip: Since Laravel’s request is already encapsulated in Request objects, integrate Input\Input by mapping $laravelRequest->all() into the constructor:

  $input = new Input($request->all(), $filter);
  

• Security Note: This package was affected by CVE-2022-23799 in 2.x. Ensure you’re using 3.0.2+ or 4.x (requires PHP 8.3+).

• Testing Tip: Use getMockBuilder() to mock Input\Input. Inject mock data in the constructor rather than redefining $_REQUEST.