Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:86830 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 21965 invoked from network); 24 Jun 2015 02:50:16 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 24 Jun 2015 02:50:16 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.50 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.213.50 mail-yh0-f50.google.com Received: from [209.85.213.50] ([209.85.213.50:35508] helo=mail-yh0-f50.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id BB/71-11255-7EA1A855 for ; Tue, 23 Jun 2015 22:50:16 -0400 Received: by yhak3 with SMTP id k3so11653704yha.2 for ; Tue, 23 Jun 2015 19:50:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=oxryKuSEzszqIXrRFlpRyzHafJpVfbnQM09D4jAOoeo=; b=ebYKn7G7Y+/ZMJzuRfahCLWv6HoFKz7ZdUtETGYaMsFyhgfcrHMn0JyvnINfYNwdgr KYxIz1YjeGRAGpsN7ETKg64yLwze5DG8w7J5ueWdCwmvjSoiloD2wKlRSmMGq2vPO7Vo IOALOI2tjd5ia9tknk6y40a5cg/GN2TD+Ko7x5650o9I8hphTuJeHH3XydJ9H+oZzOem snpLNG3pBz9bofowEujxHc2crNl/A84VwdA+W/pINUIIM+Z5amQx8rWWnaP7poaYmgup nkkNGsN5fATg/8rr4fGCR7WrLz37OVoJYFCmGpHsFJvp69xQ1hofTEdRCOMWRLduThSm lS+A== X-Received: by 10.129.93.136 with SMTP id r130mr9975915ywb.52.1435114213180; Tue, 23 Jun 2015 19:50:13 -0700 (PDT) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.129.48.129 with HTTP; Tue, 23 Jun 2015 19:49:33 -0700 (PDT) In-Reply-To: References: Date: Wed, 24 Jun 2015 11:49:33 +0900 X-Google-Sender-Auth: TQoEi5fOY4bwFOJXdQde0ULHUlk Message-ID: To: Xinchen Hui Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a114d80fae38aa705193a90cd Subject: Re: [PHP-DEV] Optimizing php_html_entities() From: yohgaki@ohgaki.net (Yasuo Ohgaki) --001a114d80fae38aa705193a90cd Content-Type: text/plain; charset=UTF-8 Hi Xinchen, On Wed, Jun 24, 2015 at 11:42 AM, Xinchen Hui wrote: > and for the "age" usage you replied in github, I think the author of > such codes should be aware, if it's only number, then instead of > htmlespcicalchars($age), he should use echo $age directly... which is > more faster. > To build secure apps, users MUST escape everything for the context by _default_. Selective escaping is the cause of injection vulnerability especially with language like PHP. Principle is "Don't think, escape all (for the context)". Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --001a114d80fae38aa705193a90cd--