Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63151
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5059EE09.1010802@ajf.me>
References: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com>
	<CALtuQzC4e2Sn_BHinFAPdVrz8Oc_d6wCqTr=AscMChH29NSENw@mail.gmail.com>
	<CAO1hux9+4QK2sVX9+4110ksa9qDpUpfDhFJvyzkXcBHrFoFWvg@mail.gmail.com>
	<0960EAA5-17FF-4E0F-9DDE-BB93D13EA02B@gmail.com>
	<CAO1hux9t9refYHYnKhY0725MvRm88ab85Ng23LCvnjDJxqQA7g@mail.gmail.com>
	<CALwr1GnjjjMbK8-VkVO57meDAgDn8PSPoWdj2DjYMB7F01dP4Q@mail.gmail.com>
	<CAPwsocGs=5-JfpSSewDRaNC0KaoNF1okBD8-E27fx5U=9f6sgw@mail.gmail.com>
	<72B22976-6F00-4EF5-88B3-140576CFE4E7@gmail.com>
	<5059EE09.1010802@ajf.me>
Date: Wed, 19 Sep 2012 09:50:00 -0700
Message-ID: <CAKa35F5H551QOwHUuZvGtHy9noGYL6XNd+BBfL+ppULB=7B6Wg@mail.gmail.com>
To: Andrew Faulds <ajf@ajf.me>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class
From: mike503@gmail.com (Michael Shadle)

On Wed, Sep 19, 2012 at 9:08 AM, Andrew Faulds <ajf@ajf.me> wrote:

> Yes, but typing the encoding every time is cumbersome. Or, if you don't want
> to set it every time, you'd have to set it globally. Then, you forgot to
> change it back somewhere when you're dealing with multiple encodings, and it
> all goes wrong.

then write a reusable function. same amount of code as an OO method.
since everyone likes to make OO classes for every little thing.

>> After that it seems like the discussion would be:
>> 1) do we even need encoding or is UTF8 just fine
>
> UTF8-only is certainly not just fine.

That's fine :) Just a suggestion for discussion. Keep encoding in
then! (I was thinking about htmlspecialchars and such)