Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68948
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <op.w21u24l6c9evq2@nikita-pc>
References: <CAGa2bXaf0MefCj6s_MEbJmnSk8G+hvm5CMNyH_ODeRhSub5LRg@mail.gmail.com>
	<CAPwsocFgv2dNGo7+5KxayrSinvm8aieKvj-WcT21ACAPLMCBrg@mail.gmail.com>
	<CAGa2bXbptncHo5vNwuySvhj8hPLFg14u4jVu8tDptVKfN7S=3A@mail.gmail.com>
	<CAFMT4NrxFciCZL4ENdSCqRW3cYyWWKQFWMJRM+95FBkDXPaPkg@mail.gmail.com>
	<522B4F8D.2040107@mjburgess.co.uk>
	<op.w21u24l6c9evq2@nikita-pc>
Date: Sat, 7 Sep 2013 10:43:01 -0600
Message-ID: <CAFMT4Npvz8+PrSZQx=P375TSQLsCX7L=a3iYm6Kz_7rSLOiiJA@mail.gmail.com>
To: Nikita Nefedov <inefedor@gmail.com>
Cc: internals <internals@lists.php.net>, Michael John Burgess <michael@mjburgess.co.uk>
Content-Type: multipart/alternative; boundary=001a11c2a1202cc92604e5cdd9eb
Subject: Re: [PHP-DEV] [RFC] Escaping RFC for PHP Core - Updates?
From: morrison.levi@gmail.com (Levi Morrison)

--001a11c2a1202cc92604e5cdd9eb
Content-Type: text/plain; charset=ISO-8859-1

On Sat, Sep 7, 2013 at 10:36 AM, Nikita Nefedov <inefedor@gmail.com> wrote:

> On Sat, 07 Sep 2013 20:08:45 +0400, Michael John Burgess <
> michael@mjburgess.co.uk> wrote:
>
>  On 07/09/2013 15:41, Levi Morrison wrote:
>>
>>> It looks nicer than Escaper::escapeJs(), Escaper::escapeHtml(), etc.
>>>>
>>>> Any comments?
>>>>
>>>
>>>
>>> Please, don't go down this route. You do not want one class to escape all
>>> kinds of data; delegate each type of escaping to its own class:
>>>
>>> JavaScriptEscaper->escape();
>>> PhpEscaper->escape();
>>> HtmlEscaper->escape();
>>> HtmlAttributeEscaper->escape()**;
>>>
>>> I should not have to defend this but I am willing to explain in more
>>> detail
>>> if someone would like me to.
>>>
>>>
>>
>> There doesnt need to be any object-oriented version for this problem.
>> It's a series of pure functions. Wraping them in one or more classes adds
>> nothing.
>>
>> Michael
>>
>>
> Hi,
>
> Wrapping those functions in methods means they can be extended in child
> classes. So suppose you have some library that takes object of type
> Spl_Escaper and uses its methods for escaping some data. Now if you will
> need some additional escaping you just need to make child class for
> Spl_Escaper and override methods which behavior you need to change. This
> can't be done with pure functions (in PHP).


You have a flawed understanding of good functional design. Instead of
directly calling the escaping function you would simply ask for a callable
and pass in the escaping function. Thus, you could use an alternative
escaping function at runtime.

The methods route is a poor choice. If we use classes at all, separate the
responsibility of each type of escaping to a separate class. Escaping JSON
and HTML code have little (possibly nothing) in common and do not belong in
the same class.

--001a11c2a1202cc92604e5cdd9eb--