Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94098
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.50 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20160617202344.2868F1A80C02@dd1730.kasserver.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
Date: Fri, 17 Jun 2016 16:27:54 -0600
Message-ID: <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
To: Thomas Bley <mails@thomasbley.de>
Cc: michael.vostrikov@gmail.com, 
	"internals@lists.php.net" <internals@lists.php.net>, Stanislav Malyshev <smalyshev@gmail.com>
Content-Type: multipart/alternative; boundary=001a113e59f2ac77fe053580dd14
Subject: Re: [PHP-DEV] New escaped output operator
From: derokorian@gmail.com (Ryan Pallas)

--001a113e59f2ac77fe053580dd14
Content-Type: text/plain; charset=UTF-8

On Fri, Jun 17, 2016 at 2:23 PM, Thomas Bley <mails@thomasbley.de> wrote:

> you can simply add the context to the current output operator:
> <?=html($str) ?>
> <?=attr($str) ?>
> <?=text($str) ?> (=strip_tags)
> <?=js($str) ?>
> <?=css($str) ?>
>

Look at that. Add a couple parens and its completely implementable in
userland now with no language changes required.


> Regards
> Thomas
>
> Stanislav Malyshev wrote on 17.06.2016 22:14:
>
> > Hi!
> >
> >> Most of output code is an output of properties of database entities, and
> >> only in some cases it's needed to concatenate HTML into string and then
> >> print it with unescaped output. Escaped output operator can be useful.
> Also
> >> we output data not into the void and not into simple text file, but into
> >> HTML-document which has a certain format (markup). Also this is logical
> -
> >> to have both forms, escaped and unescaped.
> >
> > This has been discussed on the list a number of times. Main issue with
> > this kind of proposals is that escaping is context-dependent. E.g.
> > htmlspecialchars() would not help you in many scenarios - e.g. it won't
> > protect you from XSS if you ever place user-controlled data in HTML
> > attributes. Having operator for each of the possible contexts does not
> > really looks feasible, and having it for only one of them and not the
> > others would be misleading people into thinking this operator is generic
> > and can be used in all contexts safely.
> >
> > --
> > Stas Malyshev
> > smalyshev@gmail.com
> >
> > --
> > PHP Internals - PHP Runtime Development Mailing List
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--001a113e59f2ac77fe053580dd14--