Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86816
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.49 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CABBJUpeaVXXJ-JJDP+oHUamuDGwM87Myvm4_0qXAh2cZn8rg3A@mail.gmail.com>
References: <CAGa2bXa9x_BK9O78N_yvAVj7M5V0UEGsy3ch-VOimaqGaKUA3w@mail.gmail.com>
 <CABBJUpeaVXXJ-JJDP+oHUamuDGwM87Myvm4_0qXAh2cZn8rg3A@mail.gmail.com>
Date: Wed, 24 Jun 2015 06:37:56 +0900
Message-ID: <CAGa2bXZR2+omdNy8WNGO-ROGFz1ub+ayPFm6iyeyXMv3hPeryg@mail.gmail.com>
To: Xinchen Hui <laruence@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114fae22759d160519363679
Subject: Re: [PHP-DEV] Optimizing php_html_entities()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a114fae22759d160519363679
Content-Type: text/plain; charset=UTF-8

Hi Xinchen,

On Tue, Jun 23, 2015 at 11:33 PM, Xinchen Hui <laruence@php.net> wrote:

> But passing an non-string to htmlspecialchars are not common used cases..
>
> "optimize" not common used cases... will bring nothing to us..
>

The reason why I brought up this now is scalar type hint.
Before PHP7, people didn't not care if data sent from browser is
actually a string. e.g. age, month, date, etc.

However, this optimization have more effects because of PHP7's type hint
that convert data type "always" and users must escape regardless of it's
type. Wrong date type assumption is common source of JavaScript injections.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a114fae22759d160519363679--