Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72199
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.173 as permitted sender)
Message-ID: <52F0FEE8.5010302@gmail.com>
Date: Tue, 04 Feb 2014 14:53:28 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com> <52EDBB30.3070209@ajf.me> <CAGa2bXYMPM2+HinAANcDv2gvGNtfPHYFcKr=qrmXrsRPEbsiog@mail.gmail.com> <52EE1C2B.7030702@sugarcrm.com> <CAGa2bXYJAz8jMRmL4d9uHvspzg12km=ZosBtvqwywwc1wzmVuw@mail.gmail.com> <52EF50B6.1030404@sugarcrm.com> <CALwr1Gn95__kSkJfhseemSN=kugeymeW0-sT4yPC9_XBZp4VJg@mail.gmail.com> <CAGa2bXakngpviwqvbSKnMOtKMMtfwR5ZCfUx+4EDATv-2QqiwA@mail.gmail.com> <52F01654.6080903@sugarcrm.com> <CAGa2bXYkFPoUFgLT3DJr_Hq5yJjjJChXRn3hu-5q9hKndDsmpw@mail.gmail.com>
In-Reply-To: <CAGa2bXYkFPoUFgLT3DJr_Hq5yJjjJChXRn3hu-5q9hKndDsmpw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: rowan.collins@gmail.com (Rowan Collins)

Yasuo Ohgaki wrote (on 03/02/2014):
> On Tue, Feb 4, 2014 at 7:21 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:
>
>> Nowhere in any standard it says we must use htmlentities to support
>> every possible context.
>
> We may or may not support unquoted attributes.
> I think it's really dangerous, therefore we my not support it ;)
> It may be good for PHP to declare "We support HTML5!", though.

I think part of the misunderstanding here is the distinction between 
"should PHP support an appropriate escape mechanism for this situation?" 
and "should the htmlentities() function be extended to be the 
appropriate escape mechanism for this situation?"

The security requirement is for *users* to use appropriate escaping, and 
quoting, mechanisms for the output formats they use. The combination of 
quoted attributes and htmlspecialchars() with ENT_QUOTES is a secure 
escaping method, provided by the core of PHP.

HTML5 *allows* users to use non-quoted attributes, but PHP does not 
currently have a built-in function which provides adequate escaping for 
that scenario. Such a function would need to do more than just escaping 
/, as others have pointed out; for instance, it would need to either 
escape, filter, or reject all forms of whitespace.

I have no real opinion on what that function should be, except that I 
will personally never use it, because I will simply put quotes around my 
attributes and remove any need for it.

Regards,
Rowan Collins
[IMSoP]