Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63153
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH8KiXJqew3gcPPOQbATHTQnm1zE1G6GNetAGXh4Cni8i_M6Kw@mail.gmail.com>
References: <CAO1hux8mmUsy4badiNjxTGMubaduD1gkgbw4ZK1Me_MwGwLybA@mail.gmail.com>
	<CALtuQzC4e2Sn_BHinFAPdVrz8Oc_d6wCqTr=AscMChH29NSENw@mail.gmail.com>
	<CAO1hux9+4QK2sVX9+4110ksa9qDpUpfDhFJvyzkXcBHrFoFWvg@mail.gmail.com>
	<0960EAA5-17FF-4E0F-9DDE-BB93D13EA02B@gmail.com>
	<CAO1hux9t9refYHYnKhY0725MvRm88ab85Ng23LCvnjDJxqQA7g@mail.gmail.com>
	<CALwr1GnjjjMbK8-VkVO57meDAgDn8PSPoWdj2DjYMB7F01dP4Q@mail.gmail.com>
	<CAPwsocGs=5-JfpSSewDRaNC0KaoNF1okBD8-E27fx5U=9f6sgw@mail.gmail.com>
	<72B22976-6F00-4EF5-88B3-140576CFE4E7@gmail.com>
	<CAH8KiX+AmGxnZ_j0KD-1FZ0gLOuYScEx9YURBQWAep_b1T6vTw@mail.gmail.com>
	<FE6A0705-9D5C-4FE4-AB1E-2FC18EFE4557@strojny.net>
	<5059F033.80706@ajf.me>
	<CAH8KiXJqew3gcPPOQbATHTQnm1zE1G6GNetAGXh4Cni8i_M6Kw@mail.gmail.com>
Date: Wed, 19 Sep 2012 09:57:56 -0700
Message-ID: <CAKa35F6AQATnBUq1XAuTK9+8xe_iMG4e6Yu+txxLjQ91wfaUFQ@mail.gmail.com>
To: Michael Stowe <me@mikestowe.com>
Cc: Andrew Faulds <ajf@ajf.me>, Lars Strojny <lars@strojny.net>, Leigh <leight@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: mike503@gmail.com (Michael Shadle)

On Wed, Sep 19, 2012 at 9:21 AM, Michael Stowe <me@mikestowe.com> wrote:

> Andrew, I'm the biggest advocate of OOP out there, but the purpose of this
> is to provide a nice convenient layer for all developers to use to properly
> escape code and increase security within their applications.  As such, we
> need to cater to the resistance...err, I mean Procedural Purists and those
> who are beginning PHP development and are not yet comfortable with OOP.

If you want to play with OO all day, then use Java. PHP was built on
procedural, and now all you OO fanboys are going nuts with it. :) On a
short-lived web request I see no reason to complicate and obfuscate
the code with OO.

This is becoming religious now, and a fight I will probably lose, but
think about PHP core, it does not need to actually start having "OO
only" stuff, especially when we're talking about one-line functions.

Next you'll start saying "why can't I do $string = new String();
$string->input($input); $string->replace($output);" or something,
instead of str_replace.

You can always build something from a basic simple foundation, which
is how PHP's OO is built anyway. Don't complicate things because of
personal preference. There is no reason it cannot stay a simple
function call or two. Wrap that in as many classes as you wish on your
own time. :)