Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63070
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5058A697.30903@sugarcrm.com>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
	<5058A697.30903@sugarcrm.com>
Date: Tue, 18 Sep 2012 12:56:03 -0400
Message-ID: <CAAyV7nF82MW1gRpVpiVooCNyj7YE-eVDqjzqFX0m3X1J7Kp_UA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: =?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d0401f929fb3d4704c9fcc346
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: ircmaxell@gmail.com (Anthony Ferrara)

--f46d0401f929fb3d4704c9fcc346
Content-Type: text/plain; charset=ISO-8859-1

Stas,

On Tue, Sep 18, 2012 at 12:51 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

> Hi!
>
> > I've written an RFC for PHP over at: https://wiki.php.net/rfc/escaper.
> > The RFC is a proposal to implement a standardised means of escaping
> > data which is being output into XML/HTML.
>
> We already have filter extension. Is it really necessary to invent yet
> another way of filtering data?
>

Filtering is very different from escaping. They each handle similar but
unique problems:

http://stackoverflow.com/questions/4218136/is-filter-input-escape-output-still-valid-with-pdo/4218219#4218219


> Also, a problem with putting code of this complexity in core would be
> that if it every had a defect - e.g. we forgot to account for some weird
> browser quirk that does not follow RFCs, or some strange encoding
> combination, or just a plain bug - it would be very hard for the users
> to mitigate without upgrading PHP - which is not always under their
> control. When using PHP code, they could just d/l new ZF class, but with
> core implementation it'd be much harder.
>
> So far I am not convinced we should really do it. But if somebody
> creates PECL extension and it proves popular, it may be merged into core
> once it does.
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
> (408)454-6900 ext. 227
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--f46d0401f929fb3d4704c9fcc346--