Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63585
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
References: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
Date: Sun, 21 Oct 2012 14:44:06 +0100
Message-ID: <CAKxcST8KyyzAjZbgwBrERuzE=1gHi4Rp1=p++ymMGaKhify4mg@mail.gmail.com>
To: Charlie Somerville <charlie@charliesomerville.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=f46d0401f4494420bb04cc91ee8a
Subject: Re: [PHP-DEV] HTML escaped short echo tag
From: dragoonis@gmail.com (Paul Dragoonis)

--f46d0401f4494420bb04cc91ee8a
Content-Type: text/plain; charset=ISO-8859-1

On Sun, Oct 21, 2012 at 2:35 PM, Charlie Somerville <
charlie@charliesomerville.com> wrote:

> Hi internals,
>
> I'd like to propose a new short tag that echos with HTML escaping.
>
> XSS is still a significant problem for PHP apps, but it is less common in
> apps written with frameworks that provide automatic HTML escaping. However,
> many developers are still writing straight PHP without any framework and a
> feature like this in PHP itself could prove to be incredibly handy.
>
> One approach I sometimes use is defining a global function called h() which
> passes its argument through htmlspecialchars(). This works well, but it
> still adds a little bit of unwanted mental and typing overhead.
>
> Since escaping is desired the vast majority of the time , I'd like to see a
> short tag for outputting with escaping. This tag could become the de facto
> standard for echoing data, with <?= being seen as the more dangerous
> alternative.
>
> The new tag should be just as short and easy to type as <?=. Personally I'm
> a fan of <?- or perhaps <?~.
>
> Looking forward to hearing some feedback on this idea.
>

How do you propose we customise the escaping of such things, using
htmlentities() or htmlspecialchars? What about the ENT_QUOTES options, or
the charset to be used (UTF-8)?

If you standardise such functionality then you'll need to have a callback
executed.

I'm personally not a fan of your new syntax because it ass more  variations
to the way PHP is invoked and outputting information, but perhaps a generic
escape() function is in order. Maybe you're onto something, but I feel the
new php-invoking syntax isn't the way to go about it.

- Paul.


>
> Cheers,
>
> Charlie.
>

--f46d0401f4494420bb04cc91ee8a--