Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71973
Return-Path: <php@golemon.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 26956 invoked from network); 2 Feb 2014 03:35:49 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 2 Feb 2014 03:35:49 -0000
Authentication-Results: pb1.pair.com smtp.mail=php@golemon.com; spf=softfail; sender-id=softfail
Authentication-Results: pb1.pair.com header.from=php@golemon.com; sender-id=softfail
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 209.85.192.181 as permitted sender)
X-PHP-List-Original-Sender: php@golemon.com
X-Host-Fingerprint: 209.85.192.181 mail-pd0-f181.google.com  
Received: from [209.85.192.181] ([209.85.192.181:36686] helo=mail-pd0-f181.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id D2/E1-30967-51DBDE25 for <internals@lists.php.net>; Sat, 01 Feb 2014 22:35:49 -0500
Received: by mail-pd0-f181.google.com with SMTP id y10so5643832pdj.26
        for <internals@lists.php.net>; Sat, 01 Feb 2014 19:35:46 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:sender:in-reply-to:references:date
         :message-id:subject:from:to:cc:content-type;
        bh=/pnWufGDqPCXidTAI/hQspB+7WJSpokExunzt+jI3C4=;
        b=EYh8a/v3gdoLD6C/ZsytcGjKpPBA3FFLctXT+3RcugIECXz8/ztEQYnEB7tZq8os7V
         tnxIK8hHmuwyeaAuJ+doD5Okr8O+2Hv8Jd31XlwHUEk03SlUpdz7f7ML0+jrgwMZqUsM
         w0G3ErvjC3I0x1H9jr/2TuA8SCurfAssNew4ruvbaERxlbjtJzhQtVr9jzOxKIDw1vw1
         Q82lXYIKScexSZgNjWZNmLjTms6HmlfmgVJ6GmTQ4cZNow1KUD3V2A7mATrnmFG01UCI
         sbCil3W1uCoMYMHCuj7Iah0bpU4AJhSIzVssOKwy6PTnF6vsANlPIHd3bqjsfYQjU8xG
         B+3Q==
X-Gm-Message-State: ALoCoQnJ88WUeykqIYXWPYNnrkdiSSxTqqjggVtoEj/JaI6O+dN8qB7egSsyEL0Mf38epBSBZmZh
MIME-Version: 1.0
X-Received: by 10.66.217.133 with SMTP id oy5mr30093464pac.46.1391312146110;
 Sat, 01 Feb 2014 19:35:46 -0800 (PST)
Sender: php@golemon.com
Received: by 10.70.77.164 with HTTP; Sat, 1 Feb 2014 19:35:46 -0800 (PST)
X-Originating-IP: [173.252.71.189]
In-Reply-To: <CAGa2bXYVV8sjK2EWGgYdDBONCPUzh4wR_mUKFAm7f+RyvAFT7Q@mail.gmail.com>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
	<CAESVnVrJN=WE85zcyvyfBFCJhuQ1FPYBs+Tt25fcYY+pQMGy1g@mail.gmail.com>
	<CAGa2bXYVV8sjK2EWGgYdDBONCPUzh4wR_mUKFAm7f+RyvAFT7Q@mail.gmail.com>
Date: Sat, 1 Feb 2014 19:35:46 -0800
X-Google-Sender-Auth: Qa_fmFCq8FYNIUiTyT3dsLNz9Ns
Message-ID: <CAESVnVoXnuUP5jzxx8LO7bd1DA0GuRsuq5_j1vc-S-p9PfXFnw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: pollita@php.net (Sara Golemon)

On Sat, Feb 1, 2014 at 7:31 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> They don't explain as code. AFAIK This is the case for generating invalid
> HTML that destroys HTML tag structure.
>
> <tag attr=<?php htmlentities($str, ENT_QUOTES, 'UTF-8') ?>>
>
> When $str is
>
> sometext /
>
> Produced HTML would be
>
> <tag attr=sometext />
>
> and tag is closed.
>
Oh, I see what the RFC is suggesting now:  Include encoding '/' by
default.  Yeah, I got no problem with that.  Seems completely
reasonable.  ((Though I twitch every time I see unquoted attributes))

-Sara