Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:50196
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 74.125.83.42 cause and error)
Message-ID: <4CE09FA5.1020505@lerdorf.com>
Date: Sun, 14 Nov 2010 18:49:09 -0800
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6
MIME-Version: 1.0
To: Gustavo Lopes <glopes@nebm.ist.utl.pt>
CC: internals@lists.php.net
References: <AANLkTi=ym7gHO55+hwYMTe6B9730DGuOXO1LrJSb9VtZ@mail.gmail.com> <4CE09044.4050108@sugarcrm.com> <4CE09CDD.7070809@lerdorf.com> <op.vl6xwwchidpuyk@damnation.dulce.lo.geleia.net>
In-Reply-To: <op.vl6xwwchidpuyk@damnation.dulce.lo.geleia.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Option to enable echo tags when short tags are turned
 off
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 11/14/10 6:44 PM, Gustavo Lopes wrote:
> On Mon, 15 Nov 2010 02:37:17 -0000, Rasmus Lerdorf <rasmus@lerdorf.com>
> wrote:
> 
>> On 11/14/10 5:43 PM, Stas Malyshev wrote:
>>> Hi!
>>>
>>>> At the beginning of the year, someone put in a request for an option
>>>> to enable echo tags when short tags are disabled
>>>> (http://bugs.php.net/bug.php?id=50662). I've written a patch and two
>>>
>>> I don't think we really need more options - I think we should just have
>>> <?= always work. There's no valid XML file out there that contains <?=
>>> and only people that use it are PHP programmes that don't care for XML
>>> validity. Why not just make it work finally?
>>> Yes, I know that was debated 100 times. But I still think disabling <?=
>>> makes no sense, so here it goes.
>>
>> Yup, I agree.  I see no reason to kill <?=
>>
> 
> The problem with <?= is that more often that not, you need to run the
> text through htmlentities or similar, so it would be of very limited
> usefulness even if it could be relied on (i.e. it always worked).

That's a very different issue and has nothing to do with whether <?=
should be there or not.  In most templating/views the variables exposed
to that part have already been filtered for display purposes.

In my stuff, for example, I always have the "full_special_chars" default
filter in place, so all user-derived variables are automatically safe.

-Rasmus