Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63097
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 213.123.26.187 cause and error)
Message-ID: <5058BD6B.9060909@lsces.co.uk>
Date: Tue, 18 Sep 2012 19:28:59 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120604 Firefox/13.0 SeaMonkey/2.10
MIME-Version: 1.0
To: PHP internals <internals@lists.php.net>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com> <5058A697.30903@sugarcrm.com> <CAAyV7nF82MW1gRpVpiVooCNyj7YE-eVDqjzqFX0m3X1J7Kp_UA@mail.gmail.com> <5058A8B8.3070404@sugarcrm.com> <5058A97A.4080900@ajf.me> <5058AABA.1040406@sugarcrm.com> <CAAyV7nHgJku5MqKY-D_Gk+DaSt-Wda3BJHsSzyS=yW6xENRi6w@mail.gmail.com> <5058AC72.4050906@ajf.me>
In-Reply-To: <5058AC72.4050906@ajf.me>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: lester@lsces.co.uk (Lester Caine)

Andrew Faulds wrote:
>> No, he's not. Filtering and escaping are two very significant concepts in
>> security. Just because PHP implemented some escaping concepts into the filter
>> function does not mean that the concerns are co-related.
> Ah, again you see, I'm confusing things :) In the security context, English
> language context, and signal processing context, a filter removes. In computer
> science, but not computer security, it processes.
>
> I'm very confused :P

A filter simply takes an input and produces an output. There is nothing to say 
that the output can't be bigger than the input? I'd happily accept a filter that 
takes one language in and outputs a different one. Alright that filter requires 
a considerably more complex processing than taking a .css file and outputting it 
as a colour coded document, or taking a piece of raw tagged html and outputting 
in a format that allows it to be displayed rather than processed in the browser.

Certainly a dictionary definition of 'filter' always implies that a reduced set 
of material comes out, so perhaps we need to use a different word, for the 
process, but the same 'process' applies to all of these 'conversions'. An input 
data format is converted to an output data format?

-- 
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk