Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91810
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ifixit.com designates 173.203.6.147 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF1yvAS3Oh_vp37q0xbQ-E-ZPfLn0c2EAEDjihqOtuq-HgZ5AQ@mail.gmail.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
 <CAESVnVprfe-0n7kq5JdoW3jVsb1jLZ+MSenQbZZJKjAXJh6NDA@mail.gmail.com>
 <CACNm7o8ahmP0GdiZmd_BPVa1jvA_bZz4oVY-krMgcq_P6LpzGg@mail.gmail.com> <CAF1yvAS3Oh_vp37q0xbQ-E-ZPfLn0c2EAEDjihqOtuq-HgZ5AQ@mail.gmail.com>
Date: Mon, 21 Mar 2016 00:28:34 -0700
Message-ID: <CACNm7o-_XFF57AR7R2J-rGfRn_jn9ott=8YLq1TkwcM1OrK4HQ@mail.gmail.com>
To: Jesse Schalken <me@jesseschalken.com>
Cc: Sara Golemon <pollita@php.net>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: daniel@ifixit.com (Daniel Beardsley)

> The similarity is that magic quotes assumed that the input data was going to
> be embedded within an SQL query without escaping, and therefore needed
> escaping. Of course that's an invalid assumption, the input data could be
> re-rendered, processed in some arbitrary way, written to a file, sent in an
> email, to another web service, etc etc.
>
> This feature makes a similar assumption about output, rather than input.
> Specifically, it assumes that the output is HTML, and what is being echoed
> hasn't already been escaped and therefore needs to be escaped.

True, but the difference is that safety is the default instead of
the exception. Every system has an assumption. It's better that
mistakes about escaping cause double-escaped html than
an XSS hole.

> that's an invalid assumption, command line scripts do echo/print of plain
> text, and I've seen PHP scripts generate JSON (eg a web service),
> JavaScript, CSS and plain text via the output buffer. Not to mention
> anything could so

I'm sorry, I wasn't clear in the RFC. This feature is meant to only be
turned on during template rendering (imagine you have a Template
class):

function render() {
   set_ini('__auto_escape', 1);
   require $this->templatePath;
   set_ini('__auto_escape', 0);
}