Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118739
Message-ID: <5E9CC8B8-7674-48D5-841B-1C87263446AB@gmail.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_14CA7176-EB63-4871-9FA2-1C2F9F4BA699"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Date: Tue, 4 Oct 2022 21:48:52 +0200
In-Reply-To: <CAGBsUrdri=hXQHy5JnVhpiz51FbnqVBHjrBg9-tj8m=vzfZtzA@mail.gmail.com>
Cc: PHP internals <internals@lists.php.net>
To: Kamil Tekiela <tekiela246@gmail.com>
References: <CAGBsUrdri=hXQHy5JnVhpiz51FbnqVBHjrBg9-tj8m=vzfZtzA@mail.gmail.com>
Subject: Re: [PHP-DEV] Sanitize filters
From: claude.pache@gmail.com (Claude Pache)

--Apple-Mail=_14CA7176-EB63-4871-9FA2-1C2F9F4BA699
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi,

> FILTER_SANITIZE_ENCODED
> FILTER_SANITIZE_SPECIAL_CHARS

See https://www.php.net/manual/en/function.filter-input.php =
<https://www.php.net/manual/en/function.filter-input.php> Example #1 for =
an example of use. Apparently, =E2=80=9Cescaping=E2=80=9D is considered =
as part of  =E2=80=9Csanitizing=E2=80=9D?

If you want to educate your users, you can consider to deprecate them in =
favor of FILTER_DEFAULT followed by `urlencode()`, respectively =
`htmlspecialchars()`. Ditto for various other FILTER_SANITIZE_* filters.

> FILTER_UNSAFE_RAW

My wild guess is that =E2=80=9Cunsafe=E2=80=9D means that =E2=80=9Cit is =
dangerous to use the result in random contexts (i.e., without properly =
escaping it, because we assume that you don=E2=80=99t even know what =
=E2=80=9Cescape=E2=80=9D means). Use FILTER_SANITIZE_ENCODED, =
FILTER_SANITIZE_SPECIAL_CHARS and/or FILTER_SANITIZE_MAGIC_QUOTES if you =
want to be safe=E2=80=9D (for some nonstandard definition of =
=E2=80=9Csafe=E2=80=9D). Of course, it should be renamed, because =
=E2=80=9Csafety=E2=80=9D may be achieved by alternative means.

=E2=80=94Claude


--Apple-Mail=_14CA7176-EB63-4871-9FA2-1C2F9F4BA699--