Web Services API handling design issues

[srokap]

Actually there are three thing's in current REST API implementation that are badly designed to say the least:

1. Optional parameters handling.

Imagine i have function 'test' getting param1 and param2, both optional. And handler function handler($a, $b).

We expect that value passed as param2 will end up always in parameter $b. But it depends on it if we provide param1 or not! If we provide param1, the value of param2 is passed as $b, if we don't it'll end up in $a...

I can't imagine how such behaviour could be expected one...

2. Function serialise_parameters breaks nested arrays, as it casts array items to string... Example:

   &param2=123&param3[1]=qwe&param3[2][3]=fdas
   

   is read as

Array
(
    [1] => qwe
    [2] => 
)

Where it should be:

Array
(
    [1] => qwe
    [2] => Array
        (
            [3] => fdas
        )

)

3. We require to register only global functions as rest handlers, and use eval with parameters serialized to string (sic!). I really don't see why don't we serialize parameters preserving it's structure, and pass it to function using call_user_func_array? It would even allow callback in array(class, method) format.

[srokap]

In 3. it should be sanitise instead of serialize ;-) Late hour.

[brettp]

The core API isn't REST. This isn't a critical severity.