Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81190
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Tue, 27 Jan 2015 11:06:23 +0900
Message-ID: <CAGa2bXbDV7wPwgvkGX5uhOS7B84YLUZ7Y--xZjd_pEQZroPKSg@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11337bfc0048ed050d98b6cc
Subject: Discussion for RFC: Set appropriate/better defaults.
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11337bfc0048ed050d98b6cc
Content-Type: text/plain; charset=UTF-8

Hi all,

I would like to write RFC that sets appropriate/better defaults by default.

For example, htmlspecialchars has following definition now.

string htmlspecialchars ( string $string [, int $flags = ENT_COMPAT |
ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool
$double_encode = true ]]] )
http://php.net/htmlspecialchars

Besides HTML5 allows non-quoted attributes, $flag default is better to be
"ENT_QUOTES | ENT_HTML401" as HTML5 accepts both " and ' as quote chars.

Another example is http_build_query(). It should escape ' ' as '%20' by
default, not '+'.

Followings are quick list that I think of.

===php.ini===
 - session.use_strict_mode=On : Enable strict session ID validation by
default
 - session.serializer=php_serialize : Use plain PHP's serialize than 'php'
which is made for register_globals=On.
 - session.hash_function=1 : Use SHA1 rather than MD5
 - session.http_only=On : Session ID should not be able to be accessed from
JS for security reasons.

 - opcache.enable=1

===functions===
- session_set_cookie_params()
BEFORE
void session_set_cookie_params ( int $lifetime [, string $path [, string
$domain [, bool $secure = false [, bool $httponly = false ]]]] )
AFTER
void session_set_cookie_params ( int $lifetime [, string $path [, string
$domain [, bool $secure = false [, bool $httponly = TRUE ]]]] )

Note: session_destory()/session_regenerate_id() should set destory flag to
TRUE, but I'll address this issue on different RFC.

- htmlspecialchars()
BEFORE
string htmlspecialchars ( string $string [, int $flags = ENT_COMPAT |
ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool
$double_encode = true ]]] )
AFTER
string htmlspecialchars ( string $string [, int $flags = ENT_QUOTES |
ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool
$double_encode = true ]]] )

- htmlentities()
BEFORE
string htmlentities ( string $string [, int $flags = ENT_COMPAT |
ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool
$double_encode = true ]]] )
AFTER
string htmlentities ( string $string [, int $flags = ENT_QUOTES |
ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool
$double_encode = true ]]] )

- htmlspecialchars_decode()
BEFORE
string htmlspecialchars_decode ( string $string [, int $flags = ENT_COMPAT
| ENT_HTML401 ] )
AFTER
string htmlspecialchars_decode ( string $string [, int $flags = ENT_QUOTES
| ENT_HTML401 ] )

- html_entities_decode()
BEFORE
string html_entity_decode ( string $string [, int $flags = ENT_COMPAT |
ENT_HTML401 [, string $encoding = ini_get("default_charset") ]] )
AFTER
string html_entity_decode ( string $string [, int $flags = ENT_QUOTES |
ENT_HTML401 [, string $encoding = ini_get("default_charset") ]] )

- http_build_query()
BEFORE
string http_build_query ( mixed $query_data [, string $numeric_prefix [,
string $arg_separator [, int $enc_type = PHP_QUERY_RFC1738 ]]] )
AFTER
string http_build_query ( mixed $query_data [, string $numeric_prefix [,
string $arg_separator [, int $enc_type = PHP_QUERY_RFC3986 ]]] )

- json_encode()
BEFORE
string json_encode ( mixed $value [, int $options = 0 [, int $depth = 512
]] )
AFTER
string json_encode ( mixed $value [, int $options = JSON_HEX_TAG |
JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT [, int $depth = 512 ]] )
Note: These options provide safety when JSON is embedded into
HTML/JavaScript context.

- uniq_id()
BEFORE
string uniqid ([ string $prefix = "" [, bool $more_entropy = false ]] )
AFTER
string uniqid ([ string $prefix = "" [, bool $more_entropy = TRUE ]] )


There may be others. Please add them if there are any
obsolete/unreasonable/insecure defaults.

Any comments?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11337bfc0048ed050d98b6cc--