Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129691
Message-ID: <2354ce9a-2444-435c-91be-2ca8fbd02f91@mail.ru>
Date: Thu, 25 Dec 2025 14:51:23 +0500
Precedence: list
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC Idea] Short echo tag with automatic HTML escaping
 (<?~ ... ?>)
To: Rob Landers <rob@bottled.codes>, Anton Smirnov <sandfox@sandfox.me>,
 internals@lists.php.net
References: <7c592a80-76a5-4b16-9c7b-a354aa34802a@mail.ru>
 <dd9cb977-37d4-4e33-ae0f-65c02502d8f9@sandfox.me>
 <c35b9f9b-9896-4b40-82fa-6d69f33b901f@mail.ru>
 <03590ce8-8037-4409-bc0e-603c692fe349@sandfox.me>
 <827cd223-226d-43c6-97f6-ccbe5492fb5e@mail.ru>
 <f31c5a9c-38ad-40ba-8db5-42d1c4a6b2eb@app.fastmail.com>
Content-Language: en-US
In-Reply-To: <f31c5a9c-38ad-40ba-8db5-42d1c4a6b2eb@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: sergei_vi@mail.ru (Sergei Issaev)

Hi!

On 12/24/25 13:14, Rob Landers wrote:
 > Maybe, you should consider something like this:
 >
 > <?:html: or <?:h:
 > <?:attr:
 > <?:url:
 > <?:js:
 > <?:css:

That’s an interesting idea! However, it goes beyond the scope of this 
RFC, which aims only to introduce a concise shorthand for the frequently 
used <?= htmlspecialchars(...) ?> pattern.

A more comprehensive solution with context-specific escaping—for 
example, for HTML, attributes, URLs, JavaScript, or CSS—would indeed be 
better implemented at the templating engine level or as a dedicated module.

Moreover, as other participants in the discussion rightly pointed out, 
relying solely on automatic escaping at the rendering layer may create a 
false sense of security if developers don’t fully consider the output 
context in which data is used. In fact, such syntax doesn’t inherently 
improve security—it primarily increases coding convenience. True safety 
still depends on an explicit and context-aware choice of encoding method.

Summary of the proposal:
Introduce a new short echo tag:

```

<?: $expr ?>

```

which compiles to:

```

<?php echo htmlspecialchars($expr); ?>

```

The encoding will be determined automatically via the current 
`default_charset` setting, as `htmlspecialchars()` does by default.

The behavior flags can be configured via a new INI directive: 
`short_echo_specialchars_flags`. By default, it matches the flag values 
used by `htmlspecialchars()`.

Thank you to everyone who contributed to the discussion.


Best regards,
Sergei Issaev