Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:71984 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 54356 invoked from network); 2 Feb 2014 09:55:22 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 2 Feb 2014 09:55:22 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.47 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.216.47 mail-qa0-f47.google.com Received: from [209.85.216.47] ([209.85.216.47:41925] helo=mail-qa0-f47.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id C7/26-30967-9061EE25 for ; Sun, 02 Feb 2014 04:55:21 -0500 Received: by mail-qa0-f47.google.com with SMTP id j5so8425666qaq.20 for ; Sun, 02 Feb 2014 01:55:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=xEnXVormwC4eE93ar8N0m5g4fQjcDRL8jaoEyPveH/M=; b=d+H1+9FCm0a2eJi6aSjHWiEb609/8C88RkvXYEg4Mbtp7iLHijC1hQWBLEd8tVAff/ GNRScNj9QlmZpHqqAgY9KJrxKYPwvOS2oZ3mZLc6qhT5mKO+DsBIpDMiCSXi8y9YsBDq VUakhzx8/SolbfiT+weW26XByzzq+y7aiHcZACSVODyHPMMSra6qLhIxYi76y7WAiXch 6WJOdxZNfgPLjEjL6xvFTMr+ol5BvsIyPKE+bE1TUv7PIOxG4nKjbtZ0aT0GXmY6PtdJ 2dwutoIXJu4RdexBnhzAmWlqn3+AdlPSW8qdmw62KiohjSZ3D42XmpTQHCGcXVWv+a2c imKg== X-Received: by 10.224.74.129 with SMTP id u1mr46500358qaj.49.1391334918965; Sun, 02 Feb 2014 01:55:18 -0800 (PST) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.224.2.194 with HTTP; Sun, 2 Feb 2014 01:54:38 -0800 (PST) In-Reply-To: References: Date: Sun, 2 Feb 2014 18:54:38 +0900 X-Google-Sender-Auth: 0aG6m0wDxHWpA8UNNPyFSBvIqnY Message-ID: To: =?UTF-8?Q?Pavel_Kou=C5=99il?= Cc: Sara Golemon , "internals@lists.php.net" Content-Type: multipart/alternative; boundary=089e01538ddc9bceb304f16967a7 Subject: Re: [PHP-DEV] [RFC] Improve HTML escape From: yohgaki@ohgaki.net (Yasuo Ohgaki) --089e01538ddc9bceb304f16967a7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Pavel, On Sun, Feb 2, 2014 at 6:38 PM, Pavel Kou=C5=99il wrot= e: > On Sun, Feb 2, 2014 at 4:31 AM, Yasuo Ohgaki wrote: > > The code is broken in first place since attribute must be enclosed by > > "(HTML5/XHTML) or '(HTML4), but many (if not most) browsers just allows > > attributes without qoutes. > > Well, the HTML5 specification says attribute values can be left > unquoted, so I'd say that the "code is broken" statement is invalid. > http://www.w3.org/TR/html-markup/syntax.html#syntax-attr-unquoted Thank you for heads up! We must have this change as a security fix, then. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --089e01538ddc9bceb304f16967a7--