Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63592
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 207.97.245.183 as permitted sender)
Message-ID: <50842A5A.2020507@sugarcrm.com>
Date: Sun, 21 Oct 2012 20:01:14 +0300
Organization: SugarCRM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120907 Thunderbird/15.0.1
MIME-Version: 1.0
To: Charlie Somerville <charlie@charliesomerville.com>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
In-Reply-To: <CAO8n+WKuPB7Q6LMUmBNMdtFoXFQguoXWo8OrqEcRqiuDJn5WgA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] HTML escaped short echo tag
From: smalyshev@sugarcrm.com (Stas Malyshev)

Hi!

> I'd like to propose a new short tag that echos with HTML escaping.

What is "HTML escaping"? Different contexts need different escaping. For
outside tags it's one escaping, for tag attribute it's another, for JS
code context - yet another. Selecting just one use case and integrating
it into the language is a bad idea - since you are basically saying
everybody should use this specific case in any case, which is wrong.

> The new tag should be just as short and easy to type as <?=. Personally I'm
> a fan of <?- or perhaps <?~.

Personally I'm hugely *not* a fan of more obscure syntax in PHP.
Especially one that will quickly lead people into writing insecure code
because of applying wrong escaping function for the context.
-- 
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227