Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91802
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ifixit.com designates 173.203.6.139 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
 <CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
Date: Sun, 20 Mar 2016 22:53:07 -0700
Message-ID: <CACNm7o8ahmP0GdiZmd_BPVa1jvA_bZz4oVY-krMgcq_P6LpzGg@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: daniel@ifixit.com (Daniel Beardsley)

> > T_ECHO (echo, <?=) and T_PRINT (print) now both emit a
> > ZEND_AST_ECHO_ESCAPE node in the syntax tree.
> >
> Interesting approach, I assume an explicit `echo $foo;` takes the
> normal ZEND_ECHO route then?

No, looking at the code and tests: echo, print, and <?= all end up
parsing to a ZEND_AST_ECHO_ESCAPE which emits a
ZEND_ECHO_ESCAPE op code when compiled. Only inline
html still compiles as ZEND_ECHO.

> > Which allows instances of `HtmlString` to pass straight through a
> > template without being modified (skipping the html_entities call).
> >
> IME once you provide an escape hatch, said hatch WILL be used.  It's
> not a question of IF.

For sure, mistakes can be made with any system, but this helps
dangerous code look *more* wrong: new HtmlString($username)
is obviously wrong. And it makes the correct things require little
to no extra code: <?= $username ?> is always safe.

> For my part, I'd toss the idea of XHP (
> https://docs.hhvm.com/hack/XHP/introduction ) back into consideration
> over something like this.

XHP is pretty sweet, but I imagine there are a decent number of people
that don't consider using it because it is such a departure from traditional
templating.

> This approach has the smell of magic quotes which we got rid of for
> very good reason.  XHP is much more explicit in separating markup from
> data and relies far less (not at all when you do it right) on escape
> hatches.

Huh, I don't see similarities to magic quotes at all. That had to do with
attempting to sanitize input data (plenty of problems with that). All
templating systems have a means of making the default output
mechanism perform escaping and a means of preventing that
escaping with, this adds the same for php templates.

>
> -Sara