Pete Stein

An interesting comment was posted as a reply to a Panels 3 bug thread at Drupal.org -- in short, I had suggested that the bug would have been a lot easier to track down if Drupal had better core-level parameter validation, and the person replying offered that the general Drupal practice was to not "babysit broken code."

Fair enough. I can certainly see the argument for not wanting to go overboard in trying to predict when a module is going to do something wrong. You'd wind up with a larger core, and module developers would probably still find plenty of ways to crash sites with sloppy code.

But the situation in question was one where the module was passing a null value to a Drupal function that was basically a wrapper for a quick PHP function call. PHP didn't like the null, choked, and produced a perfectly cryptic error message that gave no indication of what the problem was.

Frankly, that just seems unacceptable to me. A good system should not allow itself to be corrupted beyond the point of rescue without resorting to a code or database fix. In this case, and in plenty of others, a simple if !null check would have saved an hour of digging through unfamiliar code.

So there's the issue of not being able to tell where an error is happening. And of course, the frightening experience for any user unlucky enough to see the error. But the other issue is the whole unpredictability of what is going to happen when basic intra-function parameters are not validated at all. So PHP gets a null value for a function call. Does it crash the script? Does it just throw a warning? Does it take the null and run with it as though everything is fine, and cause another problem even further down the line? Who knows! And you might get different results on one system versus another, one version of PHP versus another, MySQL versus MySQLI, etc.

And finally, it just seems like a lazy cop out to blame module code for invoking Drupal functions with missing data, or data of the wrong type, etc. Granted, I'm somewhat knew to the Drupal scene, but answering an issue with "well, that's how we've always done it" gives me the impression of a person lacking imagination.