Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:63072 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 64226 invoked from network); 18 Sep 2012 17:00:44 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 18 Sep 2012 17:00:44 -0000 Authentication-Results: pb1.pair.com smtp.mail=smalyshev@sugarcrm.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=smalyshev@sugarcrm.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 67.192.241.133 as permitted sender) X-PHP-List-Original-Sender: smalyshev@sugarcrm.com X-Host-Fingerprint: 67.192.241.133 smtp133.dfw.emailsrvr.com Linux 2.6 Received: from [67.192.241.133] ([67.192.241.133:35724] helo=smtp133.dfw.emailsrvr.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id A3/02-07072-CB8A8505 for ; Tue, 18 Sep 2012 13:00:44 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp13.relay.dfw1a.emailsrvr.com (SMTP Server) with ESMTP id 82FC43D07E0; Tue, 18 Sep 2012 13:00:41 -0400 (EDT) X-Virus-Scanned: OK Received: by smtp13.relay.dfw1a.emailsrvr.com (Authenticated sender: smalyshev-AT-sugarcrm.com) with ESMTPSA id 386CF3D07DD; Tue, 18 Sep 2012 13:00:41 -0400 (EDT) Message-ID: <5058A8B8.3070404@sugarcrm.com> Date: Tue, 18 Sep 2012 10:00:40 -0700 Organization: SugarCRM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120907 Thunderbird/15.0.1 MIME-Version: 1.0 To: Anthony Ferrara CC: =?ISO-8859-1?Q?P=E1draic_Brady?= , "internals@lists.php.net" References: <5058A697.30903@sugarcrm.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class From: smalyshev@sugarcrm.com (Stas Malyshev) Hi! > Filtering is very different from escaping. They each handle similar but > unique problems: It is a purely artificial distinction. Filtering is taking one set of data and returning other set of data, it can be applied on input, output, or anywhere you want to. Just because we used filtering for input, does not mean we can't use the same for output, there is absolutely no need to reinvent the wheel just because we're using it in different place now. It is a mistake to think that because we started to use filtering on input data, now the word "filtering" means it should never applied to output and we have to invent whole new API to do the same. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227