Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71969
Return-Path: <php@golemon.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 21078 invoked from network); 2 Feb 2014 03:15:08 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 2 Feb 2014 03:15:08 -0000
Authentication-Results: pb1.pair.com header.from=php@golemon.com; sender-id=softfail
Authentication-Results: pb1.pair.com smtp.mail=php@golemon.com; spf=softfail; sender-id=softfail
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 209.85.220.44 as permitted sender)
X-PHP-List-Original-Sender: php@golemon.com
X-Host-Fingerprint: 209.85.220.44 mail-pa0-f44.google.com  
Received: from [209.85.220.44] ([209.85.220.44:32804] helo=mail-pa0-f44.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id AF/80-30967-A38BDE25 for <internals@lists.php.net>; Sat, 01 Feb 2014 22:15:06 -0500
Received: by mail-pa0-f44.google.com with SMTP id kq14so5866409pab.17
        for <internals@lists.php.net>; Sat, 01 Feb 2014 19:15:00 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:sender:in-reply-to:references:date
         :message-id:subject:from:to:cc:content-type;
        bh=rGxKJ9xPQBV3+hO8TqInjWVHX+vCqeeg5iUe/EtW0bw=;
        b=axNYKVKhdZ65qGUBD0Oh6WLzm0CfNDASnfCMhrxwbQIDsg2I4WNP/nHdA3lJclBWC8
         oRJ8v0bL3nSppqTdMaHw3xNS9I1hc8OG0INGJYZ1S72+9SO9KWFv5zPblDivuTxKFqAR
         +eXg+AJR7kf17PF/WZ4SYhauej9HBJDCl5p4lnsledmi4t1u/775+SwY3R/wM7mGfYJa
         OPlXXA13F0wdkxLyoGa17yaJzkvjwZvNxcaXGPExYmhC2bQ/p9uMn3eH3P25lNrtQ7f8
         pbij9wQHN6g9VZnTC9cdyekV/n6xETmc3Vd7aSEb1pueL5x00gH0ksCfyaKqd8/h2rfO
         n8Pw==
X-Gm-Message-State: ALoCoQkM9AkfxO94GWVGZVsmjFATF0JgVyciegUIjBP0rTT28sNRu7Bx/AwRUDW75shLKLYCmxIl
MIME-Version: 1.0
X-Received: by 10.68.139.73 with SMTP id qw9mr29205560pbb.121.1391310900171;
 Sat, 01 Feb 2014 19:15:00 -0800 (PST)
Sender: php@golemon.com
Received: by 10.70.77.164 with HTTP; Sat, 1 Feb 2014 19:15:00 -0800 (PST)
X-Originating-IP: [173.252.71.189]
In-Reply-To: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
Date: Sat, 1 Feb 2014 19:15:00 -0800
X-Google-Sender-Auth: wZoDI9yHGosEgzqoMg-30lXoWUE
Message-ID: <CAESVnVrJN=WE85zcyvyfBFCJhuQ1FPYBs+Tt25fcYY+pQMGy1g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: pollita@php.net (Sara Golemon)

On Sat, Feb 1, 2014 at 7:09 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> This is a little improvement for HTML escape.
> https://wiki.php.net/rfc/secure-html-escape
>
> "/" escape is recommended by OWASP and we may follow them.
>
Could you include some samples of malicious input and what the output
would actually look like?  It's not obvious from the RFC or the link
referenced.

-Sara