Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91800
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.182 as permitted sender)
MIME-Version: 1.0
Sender: jesseschalken@gmail.com
In-Reply-To: <CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
	<CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
Date: Mon, 21 Mar 2016 15:11:55 +1100
Message-ID: <CAF1yvAQSAQ5K0oQ6yC5==o1TLaQE8Ume9SuFo34MQou3wbPNAw@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: Daniel Beardsley <daniel@ifixit.com>, internals@lists.php.net
Content-Type: multipart/alternative; boundary=001a113f9b6a1abf7d052e874cde
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: me@jesseschalken.com (Jesse Schalken)

--001a113f9b6a1abf7d052e874cde
Content-Type: text/plain; charset=UTF-8

I agree XHP really is the right solution for this problem. It enables HTML
to be created structurally and composably with a concise inline syntax,
just like JSX/React does for JavaScript, and just like LINQ does for SQL in
C#. It's* much* better than passing around snippets of HTML as strings that
can easily break.
On Sun, Mar 20, 2016 at 3:11 PM, Daniel Beardsley <daniel@ifixit.com> wrote:
> I'd like to submit an RFC (with a pull request) for adding auto-escaping
to
> the php language.
>
> T_ECHO (echo, <?=) and T_PRINT (print) now both emit a
> ZEND_AST_ECHO_ESCAPE node in the syntax tree.
>
Interesting approach, I assume an explicit `echo $foo;` takes the
normal ZEND_ECHO route then?

> zend_write_escape is a new function pointer that points to
> php_escape_write.
>
Pluggable, good.

> The auto-escaping system can be configured with an:
> __auto_escape_exempt_class="HtmlString"
>
I wonder if allowing the classes to declare themselves as exempty (or
self-escapable) might be a better approach.

e.g.
class Foo implements HtmlEscapable {
  public function htmlEscape() {
    return htmlentites($this->whatever);
  }
}

> Which allows instances of `HtmlString` to pass straight through a
> template without being modified (skipping the html_entities call).
>
IME once you provide an escape hatch, said hatch WILL be used.  It's
not a question of IF.

For my part, I'd toss the idea of XHP (
https://docs.hhvm.com/hack/XHP/introduction ) back into consideration
over something like this.

This approach has the smell of magic quotes which we got rid of for
very good reason.  XHP is much more explicit in separating markup from
data and relies far less (not at all when you do it right) on escape
hatches.

-Sara

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

--001a113f9b6a1abf7d052e874cde--