Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63129
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.54 as permitted sender)
References: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com> <CALtuQzC4e2Sn_BHinFAPdVrz8Oc_d6wCqTr=AscMChH29NSENw@mail.gmail.com> <CAO1hux9+4QK2sVX9+4110ksa9qDpUpfDhFJvyzkXcBHrFoFWvg@mail.gmail.com>
In-Reply-To: <CAO1hux9+4QK2sVX9+4110ksa9qDpUpfDhFJvyzkXcBHrFoFWvg@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8B117)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii
Message-ID: <0960EAA5-17FF-4E0F-9DDE-BB93D13EA02B@gmail.com>
Cc: Sebastian Krebs <krebs.seb@gmail.com>,
 "internals@lists.php.net" <internals@lists.php.net>
Date: Wed, 19 Sep 2012 08:58:11 +0100
To: Tomas Creemers <tomas.creemers@gmail.com>
Subject: Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class
From: padraic.brady@gmail.com (=?utf-8?Q?P=C3=A1draic_Brady?=)

You did notice the character encoding parameter to the constructor? The poin=
t of the class is to share that little piece of state and omit it as a requi=
red method parameter thus removing one OOP layer for those practicing OOP li=
ke all the major frameworks.=20

The RFC notes already that character encoding parameters are NOT optional. T=
hey MUST be set on each call outside of the class to enforce explicitness an=
d prevent the currently popular option of imposing a non-configurable defaul=
t in libs and frameworks. Character encoding is important in escaping and as=
suming that they are interchangeable doesn't always fit the reality of brows=
er behaviour and bugs.

This would apply to static calls as much as plain functions.

Paddy

On 19 Sep 2012, at 08:39, Tomas Creemers <tomas.creemers@gmail.com> wrote:

> On Wed, Sep 19, 2012 at 8:34 AM, Sebastian Krebs <krebs.seb@gmail.com> wro=
te:
>>=20
>>=20
>> 2012/9/19 Tomas Creemers <tomas.creemers@gmail.com>
>>>=20
>>> Hi all,
>>>=20
>>>=20
>>>=20
>>> If this is going to be implemented as a class, what is the advantage
>>> of instantiation for this? Unless I'm missing it, I would propose that
>>> the functions are made static.
>>>=20
> [snip]
>>>=20
>>> Regards,
>>>=20
>>> Tomas
>>=20
>>=20
>> Hi,
>>=20
>> I guess the reason is the same like the one, why you just should avoid
>> static methods at all. But only one example: Try to extend the class and
>> then _always_ use the extended one ;)
>>=20
>> Regards,
>> Sebastian
>=20
>=20
> Isn't that what late static binding is for? It enables the use of the
> extending class (if any) from the base class.
>=20
> I really don't see what class instantiation would add to this design
> (if it's going to be a class at all). It doesn't have
> instance-specific state.
>=20
>=20
> Regards,
> Tomas
>=20
> --=20
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>=20