Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94097
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.50 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20160617203734.8BEB11A80C02@dd1730.kasserver.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <CANUQDChTNwfQ9e+Y8UCtKA+vdf4Fb28P_zS4bRz2f2Nqv9QmkA@mail.gmail.com> <20160617203734.8BEB11A80C02@dd1730.kasserver.com>
Date: Fri, 17 Jun 2016 15:20:50 -0700
Message-ID: <CAMPTd_DfN_7D1tt--nemRVU8CLWNLg5AkKqpfXe9ditJ3UVr8Q@mail.gmail.com>
To: Thomas Bley <mails@thomasbley.de>
Cc: michael.vostrikov@gmail.com, PHP Internals <internals@lists.php.net>, me@kelunik.com
Content-Type: multipart/alternative; boundary=94eb2c125464740b59053580c473
Subject: Re: [PHP-DEV] New escaped output operator
From: walterp@gmail.com (Walter Parker)

--94eb2c125464740b59053580c473
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Thomas, are you actually reading and understanding what the others are
saying?

You seem to be answering questions that have not been asked or giving the
simple, easy and wrong answer.


Walter

On Fri, Jun 17, 2016 at 1:37 PM, Thomas Bley <mails@thomasbley.de> wrote:

> using the default encoding from php.ini's default_charset should be no
> problem, htmlspecialchars() already does it if the encoding parameter is
> not provided.
>
> Regards
> Thomas
>
> Niklas Keller wrote on 17.06.2016 22:31:
>
> > Hi,
> >
> > the issue is that things have to be escaped dependent on the context. I=
f
> > you are in a HTML context you need different escaping than you need in =
a
> > CSS or JS block. The escaping should also be aware of the content
> encoding.
> > All that makes it difficult for PHP to directly support such an operato=
r.
> >
> > You can always alias "e" or something like that to be your default esca=
pe
> > function.
> >
> > Regards, Niklas
> >
> > =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=92=D0=BE=D1=81=D1=82=D1=80=D0=
=B8=D0=BA=D0=BE=D0=B2 <michael.vostrikov@gmail.com> schrieb am Fr.,
> > 17. Juni
> > 2016, 21:29:
> >
> >> Hello. I was thinking about a presence of escaped output operator in P=
HP
> >> and found this feature request: https://bugs.php.net/bug.php?id=3D6257=
4.
> I
> >> think this is quite necessary feature. There are a lot of projects
> which is
> >> written without templating engine, and there are frameworks without
> >> built-in templating engine by default. All this projects require to
> write
> >> the code. Usually it is rather simple to switch to new version of
> language,
> >> but it is almost impossible to switch many and many templates on a
> >> templating engine.
> >>
> >> Most of output code is an output of properties of database entities, a=
nd
> >> only in some cases it's needed to concatenate HTML into string and the=
n
> >> print it with unescaped output. Escaped output operator can be useful.
> Also
> >> we output data not into the void and not into simple text file, but in=
to
> >> HTML-document which has a certain format (markup). Also this is logica=
l
> -
> >> to have both forms, escaped and unescaped.
> >>
> >> I want to suggest the operator "<?~ $str ?>", which will automatically
> wrap
> >> output in htmlspecialchars(). It is mentioned in the feature request
> above.
> >> It is quite easy to type, and there is a small possibility to write "<=
?=3D
> >> ?>" instead.
> >>
> >> In PHP 7 there are new operators and other changes. I think, new echo
> >> operator also can be added. I can implement it myself.
> >>
> >
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


--=20
The greatest dangers to liberty lurk in insidious encroachment by men of
zeal, well-meaning but without understanding.   -- Justice Louis D. Brandei=
s

--94eb2c125464740b59053580c473--