Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:94093 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 94940 invoked from network); 17 Jun 2016 20:23:48 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 17 Jun 2016 20:23:48 -0000 Authentication-Results: pb1.pair.com header.from=mails@thomasbley.de; sender-id=unknown Authentication-Results: pb1.pair.com smtp.mail=mails@thomasbley.de; spf=permerror; sender-id=unknown Received-SPF: error (pb1.pair.com: domain thomasbley.de from 85.13.128.151 cause and error) X-PHP-List-Original-Sender: mails@thomasbley.de X-Host-Fingerprint: 85.13.128.151 dd1730.kasserver.com Received: from [85.13.128.151] ([85.13.128.151:59007] helo=dd1730.kasserver.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 65/EC-18862-35C54675 for ; Fri, 17 Jun 2016 16:23:47 -0400 Received: from dd1730.kasserver.com (dd0800.kasserver.com [85.13.143.204]) by dd1730.kasserver.com (Postfix) with ESMTPSA id 2868F1A80C02; Fri, 17 Jun 2016 22:23:44 +0200 (CEST) MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-SenderIP: 88.67.42.43 User-Agent: ALL-INKL Webmail 2.11 In-Reply-To: References: To: michael.vostrikov@gmail.com, internals@lists.php.net, smalyshev@gmail.com Message-ID: <20160617202344.2868F1A80C02@dd1730.kasserver.com> Date: Fri, 17 Jun 2016 22:23:44 +0200 (CEST) Subject: Re: [PHP-DEV] New escaped output operator From: mails@thomasbley.de ("Thomas Bley") you can simply add the context to the current output operator: (=strip_tags) Regards Thomas Stanislav Malyshev wrote on 17.06.2016 22:14: > Hi! > >> Most of output code is an output of properties of database entities, and >> only in some cases it's needed to concatenate HTML into string and then >> print it with unescaped output. Escaped output operator can be useful. Also >> we output data not into the void and not into simple text file, but into >> HTML-document which has a certain format (markup). Also this is logical - >> to have both forms, escaped and unescaped. > > This has been discussed on the list a number of times. Main issue with > this kind of proposals is that escaping is context-dependent. E.g. > htmlspecialchars() would not help you in many scenarios - e.g. it won't > protect you from XSS if you ever place user-controlled data in HTML > attributes. Having operator for each of the possible contexts does not > really looks feasible, and having it for only one of them and not the > others would be misleading people into thinking this operator is generic > and can be used in all contexts safely. > > -- > Stas Malyshev > smalyshev@gmail.com > > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php >