Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102411
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.20 as permitted sender)
To: Stanislav Malyshev <smalyshev@gmail.com>,
 Nikita Popov <nikita.ppv@gmail.com>, PHP internals <internals@lists.php.net>
References: <CAF+90c_+GZNrV1SC9q=Y3C=L3LMnoXX7J3zK6=kS9-sMXHZZow@mail.gmail.com>
 <521ae6bb-4771-86e0-2c35-23836fa74b6e@gmail.com>
Message-ID: <f90c14c5-09fc-1f3e-09cf-648896653279@gmx.de>
Date: Mon, 25 Jun 2018 10:10:49 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <521ae6bb-4771-86e0-2c35-23836fa74b6e@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 7.3
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 25.06.2018 at 08:12, Stanislav Malyshev wrote:

>> fgetss() function and string.strip_tags filter
> 
> I think I disagree with "strip_tags() itself, due to its limitations and
> known bugs, already has very few legitimate applications" and certainly
> the manual does not have any notice to that effect. I am not sure what
> is the reason to remove this functionality, would like to hear more
> about it - and it doesn't seem so minor as to be 1/4 of the RFC. If I
> had to vote today, I'd probably vote no just on this point.
> It may be true that strip_tags() alone without streaming part could be
> implemented easier. However, that is not a reason to drop functionality
> by itself, unless it's already completely broken. If it is, I'd like to
> hear more about it.

There are multiple bug reports regarding strip_tags()'s broken behavior
on (slightly) malformed HTML, e.g. <https://bugs.php.net/63212>,
<https://bugs.php.net/64430> and <https://bugs.php.net/74371>, which
renders the function unusable on arbitrary user supplied input.

-- 
Christoph M. Becker