Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63069
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 67.192.241.133 as permitted sender)
Message-ID: <5058A697.30903@sugarcrm.com>
Date: Tue, 18 Sep 2012 09:51:35 -0700
Organization: SugarCRM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120907 Thunderbird/15.0.1
MIME-Version: 1.0
To: =?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
In-Reply-To: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: smalyshev@sugarcrm.com (Stas Malyshev)

Hi!

> I've written an RFC for PHP over at: https://wiki.php.net/rfc/escaper.
> The RFC is a proposal to implement a standardised means of escaping
> data which is being output into XML/HTML.

We already have filter extension. Is it really necessary to invent yet
another way of filtering data?

Also, a problem with putting code of this complexity in core would be
that if it every had a defect - e.g. we forgot to account for some weird
browser quirk that does not follow RFCs, or some strange encoding
combination, or just a plain bug - it would be very hard for the users
to mitigate without upgrading PHP - which is not always under their
control. When using PHP code, they could just d/l new ZF class, but with
core implementation it'd be much harder.

So far I am not convinced we should really do it. But if somebody
creates PECL extension and it proves popular, it may be merged into core
once it does.
-- 
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227