Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129686
Feedback-ID: ifab94697:Fastmail
Precedence: list
MIME-Version: 1.0
Date: Wed, 24 Dec 2025 09:14:56 +0100
To: "Sergei Issaev" <sergei_vi@mail.ru>, "Anton Smirnov" <sandfox@sandfox.me>,
 internals@lists.php.net
Message-ID: <f31c5a9c-38ad-40ba-8db5-42d1c4a6b2eb@app.fastmail.com>
In-Reply-To: <827cd223-226d-43c6-97f6-ccbe5492fb5e@mail.ru>
References: <7c592a80-76a5-4b16-9c7b-a354aa34802a@mail.ru>
 <dd9cb977-37d4-4e33-ae0f-65c02502d8f9@sandfox.me>
 <c35b9f9b-9896-4b40-82fa-6d69f33b901f@mail.ru>
 <03590ce8-8037-4409-bc0e-603c692fe349@sandfox.me>
 <827cd223-226d-43c6-97f6-ccbe5492fb5e@mail.ru>
Subject: Re: [PHP-DEV] [RFC Idea] Short echo tag with automatic HTML escaping (<?~ ...
 ?>)
Content-Type: multipart/alternative;
 boundary=8d2699a7153d4a34bf5c518b4eb708f6
From: rob@bottled.codes ("Rob Landers")

--8d2699a7153d4a34bf5c518b4eb708f6
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable



On Wed, Dec 24, 2025, at 05:28, Sergei Issaev wrote:
> Hi Anton,
>=20
> > See above, also respecting default_charset is a must imho, not=20
> everyone uses UTF-8, East Asia specifically. Introducing a core syntax=20
> and excluding a huge portion of users is not a good move.
>=20
> The semantics of `<?: $expr ?>` would be equivalent to: `<?php echo=20
> htmlspecialchars($expr, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5); ?>` =
--=20
> that is, the encoding will be determined automatically via the current=20
> default_charset setting, as htmlspecialchars() does by default.
>=20
> Best regards,
> Sergei Issaev
>=20

I know this is not your intent, but this will give people a false sense =
of security. Much like Twig and Blade do today.

Here's some examples where this breaks, written in the context of an htm=
l doc:

<script>
  const name =3D "<?: $name ?>";
</script>

breaks with ";alert(1); //

<a href=3D"/search?q=3D<?: $query ?>"...

double encodes

window.config =3D <?: json_encode($config ?>

doesn't technically break ... but that would be a fun bug which would en=
courage devs to just turn off escaping, which defeats the purpose.

....

Maybe, you should consider something like this:

<?:html: or <?:h:
<?:attr:
<?:url:
<?:js:
<?:css:

Then you only choose the one for your context:

const name =3D <?:js: $name ?>

<a href=3D"/search?q=3D<?:attr: $query ?>"...

window.config=3D<?:js: $config ?>

.size { width=3D<?:css: $width ?>; } //prevents ;}.size:after { content=3D=
"<a..."

Its a bit more to type, but compared to googling the right way to do the=
se in all the right places and vetting/hoping that it is right... it see=
ms worth it.

=E2=80=94 Rob
--8d2699a7153d4a34bf5c518b4eb708f6
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title></head><body><div><br></div><d=
iv><br></div><div>On Wed, Dec 24, 2025, at 05:28, Sergei Issaev wrote:</=
div><blockquote type=3D"cite" id=3D"qt" style=3D""><div>Hi Anton,<br></d=
iv><div><br></div><div>&gt; See above, also respecting default_charset i=
s a must imho, not&nbsp;</div><div>everyone uses UTF-8, East Asia specif=
ically. Introducing a core syntax&nbsp;</div><div>and excluding a huge p=
ortion of users is not a good move.</div><div><br></div><div>The semanti=
cs of `&lt;?: $expr ?&gt;` would be equivalent to: `&lt;?php echo&nbsp;<=
/div><div>htmlspecialchars($expr, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML=
5); ?&gt;` --&nbsp;</div><div>that is, the encoding will be determined a=
utomatically via the current&nbsp;</div><div>default_charset setting, as=
 htmlspecialchars() does by default.</div><div><br></div><div>Best regar=
ds,</div><div>Sergei Issaev</div><div><br></div></blockquote><div><br></=
div><div>I know this is not your intent, but this will give people a fal=
se sense of security. Much like Twig and Blade do today.</div><div><br><=
/div><div>Here's some examples where this breaks, written in the context=
 of an html doc:</div><div><br></div><div>&lt;script&gt;</div><div>&nbsp=
; const name =3D "&lt;?: $name ?&gt;";</div><div>&lt;/script&gt;</div><d=
iv><br></div><div>breaks with ";alert(1); //</div><div><br></div><div>&l=
t;a href=3D"/search?q=3D&lt;?: $query ?&gt;"...</div><div><br></div><div=
>double encodes</div><div><br></div><div>window.config =3D &lt;?: json_e=
ncode($config ?&gt;</div><div><br></div><div>doesn't technically break .=
.. but that would be a fun bug which would encourage devs to just turn o=
ff escaping, which defeats the purpose.</div><div><br></div><div>....</d=
iv><div><br></div><div>Maybe, you should consider something like this:</=
div><div><br></div><div>&lt;?:html: or &lt;?:h:</div><div>&lt;?:attr:</d=
iv><div>&lt;?:url:</div><div>&lt;?:js:<br></div><div>&lt;?:css:</div><di=
v><br></div><div>Then you only choose the one for your context:</div><di=
v><br></div><div>const name =3D &lt;?:js: $name ?&gt;</div><div><br></di=
v><div>&lt;a href=3D"/search?q=3D&lt;?:attr: $query ?&gt;"...</div><div>=
<br></div><div>window.config=3D&lt;?:js: $config ?&gt;</div><div><br></d=
iv><div>.size { width=3D&lt;?:css: $width ?&gt;; } //prevents ;}.size:af=
ter { content=3D"&lt;a..."</div><div><br></div><div>Its a bit more to ty=
pe, but compared to googling the right way to do these in all the right =
places and vetting/hoping that it is right... it seems worth it.</div><d=
iv><br></div><div id=3D"sig121229152">=E2=80=94 Rob</div></body></html>
--8d2699a7153d4a34bf5c518b4eb708f6--