Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63584
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain charliesomerville.com designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
Date: Mon, 22 Oct 2012 00:35:09 +1100
Message-ID: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary=047d7b86f7463a884104cc91cebe
Subject: HTML escaped short echo tag
From: charlie@charliesomerville.com (Charlie Somerville)

--047d7b86f7463a884104cc91cebe
Content-Type: text/plain; charset=UTF-8

Hi internals,

I'd like to propose a new short tag that echos with HTML escaping.

XSS is still a significant problem for PHP apps, but it is less common in
apps written with frameworks that provide automatic HTML escaping. However,
many developers are still writing straight PHP without any framework and a
feature like this in PHP itself could prove to be incredibly handy.

One approach I sometimes use is defining a global function called h() which
passes its argument through htmlspecialchars(). This works well, but it
still adds a little bit of unwanted mental and typing overhead.

Since escaping is desired the vast majority of the time , I'd like to see a
short tag for outputting with escaping. This tag could become the de facto
standard for echoing data, with <?= being seen as the more dangerous
alternative.

The new tag should be just as short and easy to type as <?=. Personally I'm
a fan of <?- or perhaps <?~.

Looking forward to hearing some feedback on this idea.

Cheers,

Charlie.

--047d7b86f7463a884104cc91cebe--