Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72214
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52F10DE9.3040504@ajf.me>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
	<52F10DE9.3040504@ajf.me>
Date: Tue, 4 Feb 2014 21:22:26 +0000
Message-ID: <CALwr1GnsH_Qek2UEEAFmwEN+wHyamvdg73z80w98uOoGGtaCgg@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

Doing a bit of due diligence, the reason the forward slash was added
was to prevent any possibility of someone introducing a Javascript
comment into an attribute. It's very sketchy, but the theory is that
since html escaping won't escape /, using html escaping on a
javascript attribute like onmouseover might allow the browser to
interpret a comment, disregard the terminating quotes of an attribute,
and then inject HTML. Personally, it seems a bit garbled - user input
in a Javascript attribute should be escaped as a Javascript string
literal with no input injected as actual Javascript code - so it would
require both a severe browser parsing issue AND a lack of proper
contextual escaping.

Paddy