Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63586
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain charliesomerville.com designates 209.85.210.42 as permitted sender)
Date: Mon, 22 Oct 2012 01:13:15 +1100
To: Paul Dragoonis <dragoonis@gmail.com>
Cc: internals@lists.php.net
Message-ID: <84EDE3A151764E3D85A1B2C59E492E5E@charliesomerville.com>
In-Reply-To: <CAKxcST8KyyzAjZbgwBrERuzE=1gHi4Rp1=p++ymMGaKhify4mg@mail.gmail.com>
References: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
 <CAKxcST8KyyzAjZbgwBrERuzE=1gHi4Rp1=p++ymMGaKhify4mg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="508402fb_7c3dbd3d_ed2"
Subject: Re: [PHP-DEV] HTML escaped short echo tag
From: charlie@charliesomerville.com (Charlie Somerville)

--508402fb_7c3dbd3d_ed2
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

> How do you propose we customise the escaping of such things, using htmlentities() or htmlspecialchars? What about the ENT_QUOTES options, or the charset to be used (UTF-8)?
> 
> 
> 

htmlspecialchars() with ENT_QUOTES and UTF-8 should be sufficient.


> I'm personally not a fan of your new syntax because it ass more  variations to the way PHP is invoked and outputting information, but perhaps a generic escape() function is in order. Maybe you're onto something, but I feel the new php-invoking syntax isn't the way to go about it.
> 
> 
> 




To clarify - I'm not proposing any new functionality. I'm specifically proposing new syntax for existing functionality. I don't really see what benefits a generic escape() function would bring.


The idea of this proposal is that it makes escaping just as easy as not escaping. At the moment many developers have a mindset of deciding whether or not they should escape something. I'd like to see that change to a mindset of specifically deciding not to escape a certain bit of output - and having an automatic escaping syntax will help that.


On Monday, 22 October 2012 at 12:44 AM, Paul Dragoonis wrote:

> 
> 
> On Sun, Oct 21, 2012 at 2:35 PM, Charlie Somerville <charlie@charliesomerville.com (mailto:charlie@charliesomerville.com)> wrote:
> > Hi internals,
> > 
> > I'd like to propose a new short tag that echos with HTML escaping.
> > 
> > XSS is still a significant problem for PHP apps, but it is less common in
> > apps written with frameworks that provide automatic HTML escaping. However,
> > many developers are still writing straight PHP without any framework and a
> > feature like this in PHP itself could prove to be incredibly handy.
> > 
> > One approach I sometimes use is defining a global function called h() which
> > passes its argument through htmlspecialchars(). This works well, but it
> > still adds a little bit of unwanted mental and typing overhead.
> > 
> > Since escaping is desired the vast majority of the time , I'd like to see a
> > short tag for outputting with escaping. This tag could become the de facto
> > standard for echoing data, with <?= being seen as the more dangerous
> > alternative.
> > 
> > The new tag should be just as short and easy to type as <?=. Personally I'm
> > a fan of <?- or perhaps <?~.
> > 
> > Looking forward to hearing some feedback on this idea.
> 
> How do you propose we customise the escaping of such things, using htmlentities() or htmlspecialchars? What about the ENT_QUOTES options, or the charset to be used (UTF-8)? 
> 
> If you standardise such functionality then you'll need to have a callback executed.
> 
> I'm personally not a fan of your new syntax because it ass more  variations to the way PHP is invoked and outputting information, but perhaps a generic escape() function is in order. Maybe you're onto something, but I feel the new php-invoking syntax isn't the way to go about it. 
> 
> - Paul.
>  
> > 
> > Cheers,
> > 
> > Charlie.
> 


--508402fb_7c3dbd3d_ed2--