Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91815
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <56EFE897.3070804@gmail.com>
References: <CACNm7o9-6z0rxAAxnWyUFhYU+YD-QnecWrJF-PQ=z+a9qNQ=EA@mail.gmail.com>
	<CAGa2bXbjNQXwVsFmGgFVUPCFV-t2Tye+xA3MDNpA_ydjvCQ3jA@mail.gmail.com>
	<CACNm7o9NNVFrgqeufBoDgyhE-eGQix6bZwq=XGVwsROSXVb5Ag@mail.gmail.com>
	<56EFE897.3070804@gmail.com>
Date: Mon, 21 Mar 2016 12:42:03 +0000
Message-ID: <CABHuAWyfy9gvQaz94V4ajRpOzfJj=er7DOK9xMU3nNWfSTwRKg@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113f25607cb293052e8e6cfa
Subject: Re: [PHP-DEV] RFC about automatic template escaping
From: t.carnage@gmail.com (Chris Riley)

--001a113f25607cb293052e8e6cfa
Content-Type: text/plain; charset=UTF-8

Honestly, as it stands this is a pretty terrible idea.

1. It has a huge potential for introducing BC breaks.
 -  I have some code somewhere which uses output buffering and echo to
write cached copies of html pages to disk. This would break that.
 - Writing out html like structures when running as a cli shouldn't be
affected; but it probably would be.
 - Several systems store html templates in a database and echo them.
Possible breaking change here
2. Relying on an ini setting for security is a bad idea: we did that with
magic quotes and look how that turned out.
3. Ini setting changes at runtime cannot be relied upon. (Think shared
hosting providers who might switch this on(or off) globally and deny
changes to it at runtime)
4. Already mentioned but there is more to escaping than just HTML

If you decide to pursue this further try using
declare(this_is_a_template=true) at the top of each template file to enable
this badhaviour instead of an ini setting. This then applies on a per file
basis and side steps numerous issues.

--001a113f25607cb293052e8e6cfa--