Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33751
Return-Path: <stas@zend.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 6722 invoked by uid 1010); 5 Dec 2007 18:21:03 -0000
Delivered-To: ezmlm-scan-internals@lists.php.net
Delivered-To: ezmlm-internals@lists.php.net
Received: (qmail 6707 invoked from network); 5 Dec 2007 18:21:03 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 5 Dec 2007 18:21:03 -0000
Authentication-Results: pb1.pair.com header.from=stas@zend.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=stas@zend.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain zend.com designates 212.25.124.162 as permitted sender)
X-PHP-List-Original-Sender: stas@zend.com
X-Host-Fingerprint: 212.25.124.162 mail.zend.com Windows 2000 SP4, XP SP1
Received: from [212.25.124.162] ([212.25.124.162:56890] helo=mx1.zend.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 51/CA-20707-E0CE6574 for <internals@lists.php.net>; Wed, 05 Dec 2007 13:21:03 -0500
Received: from us-ex1.zend.com ([192.168.16.5]) by mx1.zend.com with Microsoft SMTPSVC(6.0.3790.3959);
	 Wed, 5 Dec 2007 20:20:59 +0200
Received: from [192.168.16.91] ([192.168.16.91]) by us-ex1.zend.com with Microsoft SMTPSVC(6.0.3790.1830);
	 Wed, 5 Dec 2007 10:20:56 -0800
Message-ID: <4756EC08.8040806@zend.com>
Date: Wed, 05 Dec 2007 10:20:56 -0800
Organization: Zend Technologies
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: Rasmus Lerdorf <rasmus@lerdorf.com>
CC: Keryx Web <webmaster@keryx.se>, 
 PHP Developers Mailing List <internals@lists.php.net>
References: <474F0EE7.8020201@php.net> <474F5F75.3030808@zend.com>	 <475081DD.90404@php.net> <4750B3CA.20405@zend.com>	 <475101FF.5080103@lerdorf.com> <475482AF.3050800@zend.com>	 <47548638.9020709@lerdorf.com> <475487D0.7050207@zend.com>	 <47549512.1000505@akbkhome.com> <4754DEA0.10105@php.net> <cd5680a20712040116o931d03exdb818ea49d2fd95c@mail.gmail.com> <47569091.3020704@keryx.se> <475692A5.7020600@lerdorf.com>
In-Reply-To: <475692A5.7020600@lerdorf.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 05 Dec 2007 18:20:56.0443 (UTC) FILETIME=[9404CCB0:01C8376B]
Subject: Re: [PHP-DEV] Proposed feature for json_encode()
From: stas@zend.com (Stanislav Malyshev)

> payload to innerHTML, you are hosed.  Using the \u syntax, even if you
> mess up and that blob of data finds its way to an innerHTML, nothing
> nasty can happen.  Basically this is a more robust context-protected way

I'm not sure this is correct - if you just write something like:

<script>
var = <?php json_encode($_GET['pleasehackme']) ?>;
myDomElement.innerHTML = var.content;
</script>

you are still in trouble, \u or not. Am I wrong?
-- 
Stanislav Malyshev, Zend Software Architect
stas@zend.com   http://www.zend.com/
(408)253-8829   MSN: stas@zend.com