Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63210
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
Date: Fri, 21 Sep 2012 08:31:59 +0200
Message-ID: <CAEZPtU4Aja9j+bexw7jh3v7GxN+rdmdkxhNuX2Mk_2=LqwcsQQ@mail.gmail.com>
To: =?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: pierre.php@gmail.com (Pierre Joye)

hi P=E1draic,

Given the current discussions about the APIs (see my other reply too)
and its usage, and that this proposal is non invasive/self contained
in an extension, I would strongly suggest to already go with it in
PECL, do releases (stay alpha until you have a very good feeling about
the API stability), etc. It will also greatly help to get more
feedback.

Then it could be proposed again for being bundled at some point,
before we go features freeze for 5.5.

Cheers,

On Tue, Sep 18, 2012 at 1:30 PM, P=E1draic Brady <padraic.brady@gmail.com> =
wrote:
> Hi all,
>
> I've written an RFC for PHP over at: https://wiki.php.net/rfc/escaper.
> The RFC is a proposal to implement a standardised means of escaping
> data which is being output into XML/HTML.
>
> Cross-Site Scripting remains one of the most common vulnerabilities in
> web applications and there is a continued lack of understanding
> surrounding how to properly escape data. To try and offset this, I've
> written articles, attempted to raise awareness and wrote the
> Zend\Escaper class for Zend Framework. Symfony 2's Twig has since
> adopted similar measures in line with its own focus on security.
>
> That's all. The RFC should be self-explanatory and feel free to pepper
> me with questions. As the RFC notes, I'm obviously not a C programmer
> so I'm reliant on finding a volunteer who's willing to take this one
> under their wing (or into their basement - whichever works).
>
> https://wiki.php.net/rfc/escaper
>
> Best regards,
> Paddy
>
> --
> P=E1draic Brady
>
> http://blog.astrumfutura.com
> http://www.survivethedeepend.com
> Zend Framework Community Review Team
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>



--=20
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org