Magento – Unable to add magento-ecg/coding-standard to PHP_CodeSniffer:

Got an unofficial answer from the ECG team on that:

First of all, the flagged functions are not necessarily disallowed - they should trigger a manual review on usage to ensure legitimate use. It's a review helper tool, not good/bad code scoring tool.

Second, the assumption was it is better to use Magento wrappers (functions/classes) if they exists as they might offer additional functionality or protection.

Third, as for specific calls, base64_decode is used often for malicious injected code, and the rest like parse_str might be vulnerable, especially handling unknown or user provided input - see for example http://php-security.org/2010/05/31/mops-2010-049-php-parse_str-interruption-memory-corruption-vulnerability/

Again, this is flagging it for review not rejecting the code as bad.

Hope it helps.