Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86837
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZrdniydE4GMqw1LxAU97WBoZUDP1AJxBhcuEiX-gfxYA@mail.gmail.com>
References: <CAGa2bXa9x_BK9O78N_yvAVj7M5V0UEGsy3ch-VOimaqGaKUA3w@mail.gmail.com>
	<CABBJUpeaVXXJ-JJDP+oHUamuDGwM87Myvm4_0qXAh2cZn8rg3A@mail.gmail.com>
	<CAGa2bXYhCNJ_uNQCRbNRhFhfz7rViJ_THUMpA+rddm0fy7gAxQ@mail.gmail.com>
	<CABBJUpdJgHyEhCANQjiB=VrNA8=LFa_sCLr87aid33cH5GTNzw@mail.gmail.com>
	<CAGa2bXa4EZiVtSR=FOuVNR=VVPfrVO4Ri-A=b82AJ-Hc94cv5Q@mail.gmail.com>
	<CABBJUpdq8f95UHAgb7X+8VkrJjqRaBiXoxAxdKednjsCsO7oGA@mail.gmail.com>
	<CAGa2bXZrdniydE4GMqw1LxAU97WBoZUDP1AJxBhcuEiX-gfxYA@mail.gmail.com>
Date: Wed, 24 Jun 2015 12:20:56 +0300
Message-ID: <CAPhkiZxDvz4LDoQ+tGiV1LDq8Y0dqTkB8r8t46_oGgrdxmDSvA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Xinchen Hui <laruence@php.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Optimizing php_html_entities()
From: narf@devilix.net (Andrey Andreev)

Hi,

On Wed, Jun 24, 2015 at 5:49 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Xinchen,
>
> On Wed, Jun 24, 2015 at 11:42 AM, Xinchen Hui <laruence@php.net> wrote:
>
>> and for the "age" usage you replied in github, I think the author of
>> such codes should be aware, if it's only number, then  instead of
>> htmlespcicalchars($age),  he should use echo $age directly... which is
>> more faster.
>>
>
> To build secure apps, users MUST escape everything for the context by
> _default_.
> Selective escaping is the cause of injection vulnerability especially with
> language like
> PHP.
>
> Principle is "Don't think, escape all (for the context)".
>

The key word here is "context" ... you know that there's nothing to
escape for an integer, because the type is your context.

Selective escaping isn't a problem by itself, but that many people use
a blacklist approach instead of a whitelist one; and you can only fix
that with education.

Cheers,
Andrey.