Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63191
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKa35F6Z8FNbDuSJpkfRNLtwxsL4MCkEmrPASeS0fOkjfr9PsA@mail.gmail.com>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
	<alpine.DEB.2.02.1209180809010.28929@whisky.home.derickrethans.nl>
	<CALwr1GnjwyE=yipK6UNkOm9m31LDDbpbcdgmr_nf0cUo+zOedw@mail.gmail.com>
	<CALwr1G=DOKmjudFFEAFY+6hmUh3q+qNe1ntWY1FLXP5GChLZdA@mail.gmail.com>
	<CAMUwpuSfd1U6aA_7o6d2jGm-i0PsLAf1MqKF8zvtcfzGFMGEXQ@mail.gmail.com>
	<0AC6EB13-3588-403B-BE73-968F12C7B7AF@gmail.com>
	<CALwr1G=0L-u7vu4gUrfO51DP50anfUbkPS+mHePzen6Aih4e7g@mail.gmail.com>
	<CAKa35F6Z8FNbDuSJpkfRNLtwxsL4MCkEmrPASeS0fOkjfr9PsA@mail.gmail.com>
Date: Thu, 20 Sep 2012 11:11:13 +0100
Message-ID: <CALwr1G=sEnU_bONCTOM2EcY0SjcPiO2C5rsEPHj_KPHfx0A6pQ@mail.gmail.com>
To: Michael Shadle <mike503@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: padraic.brady@gmail.com (=?ISO-8859-1?Q?P=E1draic_Brady?=)

Hi Michael,

> After looking over the RFC finally, would it be that crazy to consider
> this an extension of the standard string functions?
>
> str_escape($string, $encoding, $flags) or probably better
> str_escape($string, $flags, $encoding) - since encoding could be
> defaulted to UTF-8, but flags are really what differentiate the
> behavior...
>
> Then there is not a handful of functions but rather one that can be
> used as the abstraction point and the flags passed to it will change
> it's behavior, much like the filter functions.
>
> (I just see this falling under one solid defacto escape function
> standard, and it could live by itself as "escape" or something, or as
> it operates on strings, prefix it as such)

I think the filter_var() approach to using flags to switch core
behaviour is flawed for any number of reasons but consider being a
programmer writing PHP templates...

htmlspecialchars($value, ENT_QUOTES|ENT_SUBSTITUTE, 'utf-8');
str_escape($string, ESCAPE_HTML_BODY, 'utf-8');

vs

escape_html($value, 'utf-8');
$e->escapeHtml($value);

Brevity and a clear meaning have their advantages.

Paddy

--=20
P=E1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team