Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64979
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.49 as permitted sender)
Message-ID: <50F5D726.4040908@gmail.com>
Date: Wed, 16 Jan 2013 09:24:38 +1100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130106 Thunderbird/17.0.2
MIME-Version: 1.0
To: Thomas Bley <thbley+php@gmail.com>
CC: internals@lists.php.net
References: <CA+_UWzpyvYjThkyKCJZxgKMRKw5RX91EHYBLZ6-P3Yq6ze0ynA@mail.gmail.com>
In-Reply-To: <CA+_UWzpyvYjThkyKCJZxgKMRKw5RX91EHYBLZ6-P3Yq6ze0ynA@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] New operator for htmlspecialchars
From: davidkmuir@gmail.com (David Muir)

On 16/01/13 08:22, Thomas Bley wrote:
> Hello,
>
> I created a small ticket to propose a shorter syntax for htmlspecialchars:
>
> old:
> <?= htmlspecialchars($str, ENT_QUOTES) ?>
>
> new:
> <?+ $str ?>
> or:
> <?~ $str ?>
>
> any comments, pros and cons?
>
> https://bugs.php.net/bug.php?id=62574
>
> Best regards,
> Thomas
>

The problem here is that htmlspecialchars only covers html body, and not 
html attributes, or other contexts (eg js, css, urls).

You're better off using something like Zend\Escaper, or Symfony's escaper.

The escaper RFC also gives a good amount of detail:
https://wiki.php.net/rfc/escaper

As for the shorter syntax with automatic output, I think it makes the 
code harder to read.

Cheers,
David