Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63143
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
References: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com> <CALtuQzC4e2Sn_BHinFAPdVrz8Oc_d6wCqTr=AscMChH29NSENw@mail.gmail.com> <CAO1hux9+4QK2sVX9+4110ksa9qDpUpfDhFJvyzkXcBHrFoFWvg@mail.gmail.com> <0960EAA5-17FF-4E0F-9DDE-BB93D13EA02B@gmail.com> <CAO1hux9t9refYHYnKhY0725MvRm88ab85Ng23LCvnjDJxqQA7g@mail.gmail.com> <CALwr1GnjjjMbK8-VkVO57meDAgDn8PSPoWdj2DjYMB7F01dP4Q@mail.gmail.com> <CAPwsocGs=5-JfpSSewDRaNC0KaoNF1okBD8-E27fx5U=9f6sgw@mail.gmail.com>
In-Reply-To: <CAPwsocGs=5-JfpSSewDRaNC0KaoNF1okBD8-E27fx5U=9f6sgw@mail.gmail.com>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii
Message-ID: <72B22976-6F00-4EF5-88B3-140576CFE4E7@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Date: Wed, 19 Sep 2012 09:06:43 -0700
To: Leigh <leight@gmail.com>
Subject: Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class
From: mike503@gmail.com (Michael Shadle)


> It feels like this is just using classes for the sake of using
> classes, adding an unnecessary layer of complexity (and discussion)
> for no real reason except that is the RFC authors preference.

+1

First the discussion was filtering vs escaping. Now it is about how to imple=
ment it as a class etc.

I don't understand why people have any issue with it being a core procedural=
 function. You can call that from your OO code just fine. Just like any othe=
r core procedural function.

There is no reason it has to be OO. OO has to call procedural functions alre=
ady (string functions, array functions, curl, json, etc etc); but us procedu=
ral purists don't have to call OO methods and classes if we don't need to (e=
xcept now some of the DateTime IIRC which bugs me :p)

Anyway how hard is it to use something akin to the filter functions? That's w=
hat constants/flags are for.

Call it str_escape(string, flags optional, encoding optional) and be done wi=
th it. Since it won't be useful to have escape_var or escape_input type of d=
ifferentiation and this seems like it could just fit under the string family=
 of functions (I am a fan of namespaced functions by prefix)

After that it seems like the discussion would be:
1) do we even need encoding or is UTF8 just fine
2) what are the flags to be defined for different escaping methods

$.02