Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68940
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbptncHo5vNwuySvhj8hPLFg14u4jVu8tDptVKfN7S=3A@mail.gmail.com>
References: <CAGa2bXaf0MefCj6s_MEbJmnSk8G+hvm5CMNyH_ODeRhSub5LRg@mail.gmail.com>
	<CAPwsocFgv2dNGo7+5KxayrSinvm8aieKvj-WcT21ACAPLMCBrg@mail.gmail.com>
	<CAGa2bXbptncHo5vNwuySvhj8hPLFg14u4jVu8tDptVKfN7S=3A@mail.gmail.com>
Date: Sat, 7 Sep 2013 10:51:03 +0200
Message-ID: <CAEZPtU4-2bY_Qg9Kw0-fsXLYL1SSH6Ypz6CPdBfn6O_ujuFACQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: PHP internals <internals@lists.php.net>, Leigh <leight@gmail.com>
Content-Type: multipart/alternative; boundary=089e013a132a45b2dd04e5c74119
Subject: Re: [PHP-DEV] [RFC] Escaping RFC for PHP Core - Updates?
From: pierre.php@gmail.com (Pierre Joye)

--089e013a132a45b2dd04e5c74119
Content-Type: text/plain; charset=ISO-8859-1

Hi,
On Sep 7, 2013 10:35 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>
> Hi Leigh,
>
> On Sat, Sep 7, 2013 at 2:56 PM, Leigh <leight@gmail.com> wrote:
>
> > Looks like the rfc author was unable to implement it himself at the time
> > of the proposal.
> >
> > The last thing in the discussion thread looks like "implement it in PECL
> > first, and it might get bundled later"
> >
> > http://marc.info/?l=php-internals&m=134822086426610&w=2
> >
> Thank you for the info. I searched my mailbox, but I couldn't find this.
>
> It would be better to implement this as SPL_Escape class.
>
> SPL_Escape::jsString()
> SPL_Escape::phpString()
> SPL_Escape::html()
> SPL_Escape::htmlAttribute()
> etc
>
> It looks nicer than Escaper::escapeJs(), Escaper::escapeHtml(), etc.
>
> Any comments?
> Anyone mind if I edit the RFC?

I like the goal of this proposal.

It would however fits much better in ext/filter. Yes, escaping has
different purposes than filtering.

I have some worries about the implementation. It is not an easy task and
some external libraries may already have these features (esp. CSS or JS).

About the API:

To have a kind of wrapper class is not very useful. It will most likely end
with static methods with a large set of arguments or options array, not
very sexy.

Cheers,
Pierre

--089e013a132a45b2dd04e5c74119--