Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71997
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <946C4AF4-4656-4F7A-B1C6-7D1144FEFB3D@rouvenwessling.de>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
	<52EDBB30.3070209@ajf.me>
	<CAGa2bXYMPM2+HinAANcDv2gvGNtfPHYFcKr=qrmXrsRPEbsiog@mail.gmail.com>
	<52EE1C2B.7030702@sugarcrm.com>
	<946C4AF4-4656-4F7A-B1C6-7D1144FEFB3D@rouvenwessling.de>
Date: Sun, 2 Feb 2014 13:55:32 +0000
Message-ID: <CALwr1Gkt2eY1dGN3jHuNKfBkyQ0KenfgZ6m5Mx3jJz69JBYMTA@mail.gmail.com>
To: =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c1f782bdb33b04f16cc273
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

--001a11c1f782bdb33b04f16cc273
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi all,

It's dated but: https://wiki.php.net/rfc/escaper I see Yasuo edited it a
wee bit in September on its 1 year anniversary to add ext/filter as an
option. I had hoped Anthony would get around to it but c'est la vie.

Without quotes you need to escape almost ALL non alphanumeric characters in
an attribute value just to make sure you cover every known and unknown
browser parsing oddity. It's just a bad practice full stop despite HTML5
allowing it.

ENT_QUOTES should be the default for obvious reasons. It escapes quotes.

htmlentities() doesn't anything more than htmlspecialchars() unless you
count turning "P=C3=A1draic =C3=93'Br=C3=A1daigh" into "P&aacute;draic
&Oacute;'Br&aacute;daigh" as a positive benefit to the Irish language and
the size of its webpages :P.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative

--001a11c1f782bdb33b04f16cc273--