Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72262
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZwDY=pAReNjn3DV2ejPqaHSdKrywAvDgrqWa=gLyAmww@mail.gmail.com>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
	<52F10DE9.3040504@ajf.me>
	<CALwr1GnsH_Qek2UEEAFmwEN+wHyamvdg73z80w98uOoGGtaCgg@mail.gmail.com>
	<CAGa2bXZwDY=pAReNjn3DV2ejPqaHSdKrywAvDgrqWa=gLyAmww@mail.gmail.com>
Date: Wed, 5 Feb 2014 10:54:07 +0000
Message-ID: <CALwr1G=SQCoUfJ9Z5nPqtB2nkfQ7Sr1AYiAW7nuAyLrwwQJULw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Andrea Faulds <ajf@ajf.me>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Yasuo,

On 5 February 2014 02:10, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Is it ready to vote?
> No more issues to discuss?
> Anyone?

I would remove all mention of htmlentities() other than briefly noting
that it would also be changed as part of the RFC. The rationale is
that the proper escaping function for HTML is htmlspecialchars() (so
emphasise that function). htmlentities() escapes anything with a
suitable HTML entity including non-special UTF-8 characters, i.e. it's
overkill and it disproportionately increases output size in
non-English languages such as Gaelic. The use of htmlentities() is
just a senseless bad habit by English speaking programmers based on
historic ties to non-Unicode output that needs to die already:
http://stackoverflow.com/questions/12648655/html-encoding-of-japanese-text

I would also split the vote into three sections:
   1. Should we escape single quotes by default?
   2. Should we escape forward slashes by default?
   3. Should we deprecate ENT_COMPAT and ENT_QUOTES?

The main risk I'd see is if people don't won't to escape forward slash
and kill the entire RFC over that one change.

You also don't mention single quotes anywhere in the RFC ;). You
should note that with an example so voters know it will be encoded by
default.

Paddy


--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative