Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63126
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.42 as permitted sender)
MIME-Version: 1.0
Sender: sebastian.krebs.berlin@gmail.com
In-Reply-To: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com>
References: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com>
Date: Wed, 19 Sep 2012 08:34:59 +0200
Message-ID: <CALtuQzC4e2Sn_BHinFAPdVrz8Oc_d6wCqTr=AscMChH29NSENw@mail.gmail.com>
To: Tomas Creemers <tomas.creemers@gmail.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=047d7b343b20b56dc904ca083402
Subject: Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class
From: krebs.seb@gmail.com (Sebastian Krebs)

--047d7b343b20b56dc904ca083402
Content-Type: text/plain; charset=ISO-8859-1

2012/9/19 Tomas Creemers <tomas.creemers@gmail.com>

> Hi all,
>
>
>
> If this is going to be implemented as a class, what is the advantage
> of instantiation for this? Unless I'm missing it, I would propose that
> the functions are made static.
>
> In other words, I would prefer this:
>
> echo Escaper::escapeHtml('<b>test</b>');
>
>
> over this:
>
> $e = new Escaper;
> echo $e->escapeHtml('<b>test</b>');
>
>
>
> Regards,
>
> Tomas
>

Hi,

I guess the reason is the same like the one, why you just should avoid
static methods at all. But only one example: Try to extend the class and
then _always_ use the extended one ;)

Regards,
Sebastian


>
>
>
> > Hi all,
> >
> > I've written an RFC for PHP over at: https://wiki.php.net/rfc/escaper.
> > The RFC is a proposal to implement a standardised means of escaping
> > data which is being output into XML/HTML.
> >
> > Cross-Site Scripting remains one of the most common vulnerabilities in
> > web applications and there is a continued lack of understanding
> > surrounding how to properly escape data. To try and offset this, I've
> > written articles, attempted to raise awareness and wrote the
> > Zend\Escaper class for Zend Framework. Symfony 2's Twig has since
> > adopted similar measures in line with its own focus on security.
> >
> > That's all. The RFC should be self-explanatory and feel free to pepper
> > me with questions. As the RFC notes, I'm obviously not a C programmer
> > so I'm reliant on finding a volunteer who's willing to take this one
> > under their wing (or into their basement - whichever works).
> >
> > https://wiki.php.net/rfc/escaper
> >
> > Best regards,
> > Paddy
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
github.com/KingCrunch

--047d7b343b20b56dc904ca083402--