Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115018
MIME-Version: 1.0
References: <CAFv4g+GjXqiZkA2fawt7jHDtDAKjB0rv=Lfbcobu7bn8B=wvpw@mail.gmail.com>
 <7b1af9310312e0b1435b93490160e08d@gmail.com> <CAJmy8YEDhqbRV6_0-QN_t5TCpwOYKihJjLhnhE4mizOtaOq_mQ@mail.gmail.com>
In-Reply-To: <CAJmy8YEDhqbRV6_0-QN_t5TCpwOYKihJjLhnhE4mizOtaOq_mQ@mail.gmail.com>
Date: Tue, 22 Jun 2021 11:59:26 +0100
Message-ID: <CAFv4g+GjL-ALbydTHdgmwL6gTG_0P9MSVFyfRNfWz4_zjwmFEA@mail.gmail.com>
To: Hans Henrik Bergan <divinity76@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000091e66c05c558af34"
Subject: Re: [PHP-DEV] [RFC] is_trusted - was is_literal
From: craig@craigfrancis.co.uk (Craig Francis)

--00000000000091e66c05c558af34
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, 22 Jun 2021 at 11:31 am, Hans Henrik Bergan <divinity76@gmail.com>
wrote:

> How is one supposed to use this? like
>
> if(!is_trusted($val)){
>     $val =3D htmlentities($str, ENT_QUOTES | ENT_HTML401 | ENT_SUBSTITUTE=
 |
> ENT_DISALLOWED, 'UTF-8', true);
> }
> echo "<div>$val</div>";




No, if anything that=E2=80=99s the opposite, and almost Taint Checking.

While this is covered in the RFC (https://wiki.php.net/rfc/is_literal) and
will be best read in context, in summary:

The developer does not use this function, instead you rely on libraries to
do that work for you. In this case you would use a HTML Templating Library
(which knows about all the complexities of HTML encoding), and you simply
provide the trusted string =E2=80=98<div>?</div>=E2=80=98 and the values se=
parately.

The Libraries will then use is_trusted(), with something like this:

https://github.com/craigfrancis/php-is-literal-rfc/blob/main/justification/=
example.php?ts=3D4

Craig

--00000000000091e66c05c558af34--