Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33729
Return-Path: <rasmus@lerdorf.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 74919 invoked by uid 1010); 5 Dec 2007 11:59:41 -0000
Delivered-To: ezmlm-scan-internals@lists.php.net
Delivered-To: ezmlm-internals@lists.php.net
Received: (qmail 74904 invoked from network); 5 Dec 2007 11:59:40 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 5 Dec 2007 11:59:40 -0000
Authentication-Results: pb1.pair.com smtp.mail=rasmus@lerdorf.com; spf=permerror; sender-id=unknown
Authentication-Results: pb1.pair.com header.from=rasmus@lerdorf.com; sender-id=unknown
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 204.11.219.139 cause and error)
X-PHP-List-Original-Sender: rasmus@lerdorf.com
X-Host-Fingerprint: 204.11.219.139 mail.lerdorf.com  
Received: from [204.11.219.139] ([204.11.219.139:41063] helo=mail.lerdorf.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id BC/F7-20707-BA296574 for <internals@lists.php.net>; Wed, 05 Dec 2007 06:59:40 -0500
Received: from UNKNOWN-10-76-40-157.yahoo.com (dip4-fw.london.corp.yahoo.com [217.12.14.240])
	(authenticated bits=0)
	by mail.lerdorf.com (8.14.2/8.14.2/Debian-1) with ESMTP id lB5BxX8K015374
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Wed, 5 Dec 2007 03:59:35 -0800
Message-ID: <475692A5.7020600@lerdorf.com>
Date: Wed, 05 Dec 2007 11:59:33 +0000
User-Agent: Thunderbird 2.0.0.9 (Macintosh/20071031)
MIME-Version: 1.0
To: Keryx Web <webmaster@keryx.se>
CC: PHP Developers Mailing List <internals@lists.php.net>
References: <474F0EE7.8020201@php.net> <474F5F75.3030808@zend.com>	 <475081DD.90404@php.net> <4750B3CA.20405@zend.com>	 <475101FF.5080103@lerdorf.com> <475482AF.3050800@zend.com>	 <47548638.9020709@lerdorf.com> <475487D0.7050207@zend.com>	 <47549512.1000505@akbkhome.com> <4754DEA0.10105@php.net> <cd5680a20712040116o931d03exdb818ea49d2fd95c@mail.gmail.com> <47569091.3020704@keryx.se>
In-Reply-To: <47569091.3020704@keryx.se>
X-Enigmail-Version: 0.95.5
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV 0.91.2/5011/Wed Dec  5 01:42:23 2007 on colo.lerdorf.com
X-Virus-Status: Clean
Subject: Re: [PHP-DEV] Proposed feature for json_encode()
From: rasmus@lerdorf.com (Rasmus Lerdorf)

Keryx Web wrote:
> Alexey Zakhlestin skrev:
>> I think I understand what the use-case is…
>>
>> If the browser doesn't know anything about <script> tag, it is
>> supposed to interpret it's contents as html… In which case, html-tags
>> which appear in javascript code will actually become active ones
>>
> 
> And in the year 2007, soon 2008, what browser would that be?
> 
> MSIE 2.0? (JScript was introduced in 3.0)
> 
> Netscape 2.0B1? (JavaScript was introduced i B2)
> 
> Mosaic?
> 
> 
> $10 to the first one who can name a browser that has a market share
> above 0.1% and will mistreat the contents in a script tag in this way.
> Nah, I'm generous, I'll make that €10!

It may not be the browser that misses the <script> tag.  It may be the
developer.  And I don't mean the trivial case of doing <script><?php
echo json_encode(...)</script>, this is more likely to happen in complex
environments where you have XHR requests returning json and doing DOM
manipulation on it.  If you mess up and end up passing the returned json
payload to innerHTML, you are hosed.  Using the \u syntax, even if you
mess up and that blob of data finds its way to an innerHTML, nothing
nasty can happen.  Basically this is a more robust context-protected way
of encoding json.  We should probably have done it this way right from
the beginning, but since we didn't and since we don't really want to
deal with the potential BC issues of changing working code, we have to
add it as an option at this point.

-Rasmus