Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91814
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.46 as permitted sender)
To: internals@lists.php.net
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
 <CAGa2bXbjNQXwVsFmGgFVUPCFV-t2Tye+xA3MDNpA_ydjvCQ3jA@mail.gmail.com>
 <CACNm7o9NNVFrgqeufBoDgyhE-eGQix6bZwq=XGVwsROSXVb5Ag@mail.gmail.com>
Message-ID: <56EFE897.3070804@gmail.com>
Date: Mon, 21 Mar 2016 12:27:03 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <CACNm7o9NNVFrgqeufBoDgyhE-eGQix6bZwq=XGVwsROSXVb5Ag@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: rowan.collins@gmail.com (Rowan Collins)

Daniel Beardsley wrote on 21/03/2016 06:35:
> You are right. Though not all those problems are serious:
> * URI escaping:
>    Does anyone really use <?= ?> or echo when generating a uri?
> * Javascript:
>    Good point, though I would say it's fairly rare to create javascript
>    code using a php template with variables. The most we ever do
>    in our app is  <?= json_encode($someArray) ?>

I've done both of these in the past (using Smarty, in my case); here's 
some example uses:

<a href="/products/<?= $product['category'] ?>/<?= $product['id'] 
?>"><?= $product['name'] ?></a>

<script>var debug_session_id = '<?= get_debug_session_id() ?>';</script>

Now, I'm not saying there aren't better ways of doing these things, but 
people absolutely do it like this, and a hook into something as 
fundamental as "echo" can't really rely on "it's quite rare" as an 
excuse for not accounting for them.

Regards,
-- 
Rowan Collins
[IMSoP]