New sniff: Flag unusable query parameters

[GaryJones]

What problem would the enhancement address for VIP?

On VIP, a selection of query parameters are stripped at the edge which so that the URLs are not cached as separate variants. These parameters are predominantly used for analytics. As such, $_GET['...'] and other ways of reading the values of the query parameters will return null on production and non-production environments.

Helping customers to appreciate when a query parameter isn't going to work on a VIP-hosted site, should save some hours of debugging.

Describe the solution you'd like

A new sniff to create violations when trying to read one of the documented parameters.

What code should be reported as a violation?

Substitute foo for any of the params in the documentation.

$_GET['foo']
$_REQUEST['foo']
filter_input( INPUT_GET, 'foo'[, ...[, ...]])

$qs = filter_input_array( INPUT_GET[, ...[, ...]] )
$qs['foo'];

There may well be other ways to retrieve query string parameters as well.

What code should not be reported as a violation?

$_GET['not-foo']
$_POST['foo']
filter_input( INPUT_POST, 'foo'[, ...[, ...]])