Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129676
Feedback-ID: ifab94697:Fastmail
Precedence: list
MIME-Version: 1.0
Date: Tue, 23 Dec 2025 11:09:46 +0100
Cc: internals@lists.php.net
Message-ID: <090074b5-8c44-4373-8834-5e49c611b17b@app.fastmail.com>
In-Reply-To: 
 <CAPhkiZxrhx5_T2ygss4P3RhdsfeK_2sfA4zcmLjJxm+_x0Cc5Q@mail.gmail.com>
References: <7c592a80-76a5-4b16-9c7b-a354aa34802a@mail.ru>
 <CAPhkiZxrhx5_T2ygss4P3RhdsfeK_2sfA4zcmLjJxm+_x0Cc5Q@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC Idea] Short echo tag with automatic HTML escaping (<?~ ...
 ?>)
Content-Type: multipart/alternative;
 boundary=06bca448b71444f987af631f4e806ac2
From: rob@bottled.codes ("Rob Landers")

--06bca448b71444f987af631f4e806ac2
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 23, 2025, at 10:55, Andrey Andreev wrote:
> Hi Sergei,
>=20
> XSS escaping is unfortunately not as simple as that. Templating engine=
s are context-aware and can know whether to apply escaping for free-form=
 text or an attribute (which can often also be validated by type), speci=
fic tag behaviors, and even whether the output is to be executed as HTML=
, XML, CSS, JS, etc.
>=20
> One-size-fits-all escaping that doesn't take such context into account=
 is not effective and even makes things worse by giving developers a fal=
se sense of security.
>=20
> Cheers,
> Andrey.

Hi Andrey,

Which template engines are context aware? The only ones I'm aware of is =
my own and Latte (which take a similar approach but is quite architectur=
ally different).

=E2=80=94 Rob
--06bca448b71444f987af631f4e806ac2
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title></head><body><div>On Tue, Dec =
23, 2025, at 10:55, Andrey Andreev wrote:</div><blockquote type=3D"cite"=
 id=3D"qt" style=3D""><div dir=3D"ltr"><div dir=3D"ltr"><div>Hi Sergei,<=
/div><div><br></div><div>XSS escaping is unfortunately not as simple as =
that. Templating engines are context-aware and can know whether to apply=
 escaping for free-form text or an attribute (which can often also be va=
lidated by type), specific tag behaviors, and even whether the output is=
 to be executed as HTML, XML, CSS, JS, etc.</div></div><div><br></div><d=
iv>One-size-fits-all escaping that doesn't take such context into accoun=
t is not effective and even makes things worse by giving developers a fa=
lse sense of security.</div><div><br></div><div>Cheers,</div><div>Andrey=
.</div></div></blockquote><div><br></div><div>Hi Andrey,</div><div><br><=
/div><div>Which template engines are context aware? The only ones I'm aw=
are of is my own and Latte (which take a similar approach but is quite a=
rchitecturally different).</div><div><br></div><div id=3D"sig121229152">=
=E2=80=94 Rob</div></body></html>
--06bca448b71444f987af631f4e806ac2--