Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94092
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.177 as permitted sender)
To: =?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=
 <michael.vostrikov@gmail.com>, internals@lists.php.net
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
Message-ID: <b9318b90-f850-12a2-459d-8995220922df@gmail.com>
Date: Fri, 17 Jun 2016 13:14:40 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0)
 Gecko/20100101 Thunderbird/45.1.1
MIME-Version: 1.0
In-Reply-To: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] New escaped output operator
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Most of output code is an output of properties of database entities, and
> only in some cases it's needed to concatenate HTML into string and then
> print it with unescaped output. Escaped output operator can be useful. Also
> we output data not into the void and not into simple text file, but into
> HTML-document which has a certain format (markup). Also this is logical -
> to have both forms, escaped and unescaped.

This has been discussed on the list a number of times. Main issue with
this kind of proposals is that escaping is context-dependent. E.g.
htmlspecialchars() would not help you in many scenarios - e.g. it won't
protect you from XSS if you ever place user-controlled data in HTML
attributes. Having operator for each of the possible contexts does not
really looks feasible, and having it for only one of them and not the
others would be misleading people into thinking this operator is generic
and can be used in all contexts safely.

-- 
Stas Malyshev
smalyshev@gmail.com