Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68951
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAFMT4Npvz8+PrSZQx=P375TSQLsCX7L=a3iYm6Kz_7rSLOiiJA@mail.gmail.com>
References: <CAGa2bXaf0MefCj6s_MEbJmnSk8G+hvm5CMNyH_ODeRhSub5LRg@mail.gmail.com>
 <CAPwsocFgv2dNGo7+5KxayrSinvm8aieKvj-WcT21ACAPLMCBrg@mail.gmail.com>
 <CAGa2bXbptncHo5vNwuySvhj8hPLFg14u4jVu8tDptVKfN7S=3A@mail.gmail.com>
 <CAFMT4NrxFciCZL4ENdSCqRW3cYyWWKQFWMJRM+95FBkDXPaPkg@mail.gmail.com>
 <522B4F8D.2040107@mjburgess.co.uk> <op.w21u24l6c9evq2@nikita-pc> <CAFMT4Npvz8+PrSZQx=P375TSQLsCX7L=a3iYm6Kz_7rSLOiiJA@mail.gmail.com>
Date: Sat, 7 Sep 2013 18:55:25 +0200
Message-ID: <CAA9esyTKAGGqchq-Aq9W8E=aZJmuNVb2ysb1SgkPKoHvbFhijw@mail.gmail.com>
To: Levi Morrison <morrison.levi@gmail.com>
Cc: Nikita Nefedov <inefedor@gmail.com>, internals <internals@lists.php.net>, 
	Michael John Burgess <michael@mjburgess.co.uk>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Escaping RFC for PHP Core - Updates?
From: florinpatan@gmail.com (Florin Patan)

On Sat, Sep 7, 2013 at 6:43 PM, Levi Morrison <morrison.levi@gmail.com> wrote:
> On Sat, Sep 7, 2013 at 10:36 AM, Nikita Nefedov <inefedor@gmail.com> wrote:
>
>> On Sat, 07 Sep 2013 20:08:45 +0400, Michael John Burgess <
>> michael@mjburgess.co.uk> wrote:
>>
>>  On 07/09/2013 15:41, Levi Morrison wrote:
>>>
>>>> It looks nicer than Escaper::escapeJs(), Escaper::escapeHtml(), etc.
>>>>>
>>>>> Any comments?
>>>>>
>>>>
>>>>
>>>> Please, don't go down this route. You do not want one class to escape all
>>>> kinds of data; delegate each type of escaping to its own class:
>>>>
>>>> JavaScriptEscaper->escape();
>>>> PhpEscaper->escape();
>>>> HtmlEscaper->escape();
>>>> HtmlAttributeEscaper->escape()**;
>>>>
>>>> I should not have to defend this but I am willing to explain in more
>>>> detail
>>>> if someone would like me to.
>>>>
>>>>
>>>
>>> There doesnt need to be any object-oriented version for this problem.
>>> It's a series of pure functions. Wraping them in one or more classes adds
>>> nothing.
>>>
>>> Michael
>>>
>>>
>> Hi,
>>
>> Wrapping those functions in methods means they can be extended in child
>> classes. So suppose you have some library that takes object of type
>> Spl_Escaper and uses its methods for escaping some data. Now if you will
>> need some additional escaping you just need to make child class for
>> Spl_Escaper and override methods which behavior you need to change. This
>> can't be done with pure functions (in PHP).
>
>
> You have a flawed understanding of good functional design. Instead of
> directly calling the escaping function you would simply ask for a callable
> and pass in the escaping function. Thus, you could use an alternative
> escaping function at runtime.
>
> The methods route is a poor choice. If we use classes at all, separate the
> responsibility of each type of escaping to a separate class. Escaping JSON
> and HTML code have little (possibly nothing) in common and do not belong in
> the same class.


How about allowing to register a custom escape function for each type
which can override the native one or the previous registered one?
There should be no way to restore a previous user registered function
but there should be a way to reset it to the internal php one. That
would solve the described problem as well as keeping it simple.
And having this as a class doesn't add anything imho, mainly due to
the point described above by Levi.


Kind regards
----
Florin Patan
https://github.com/dlsniper
http://www.linkedin.com/in/florinpatan