Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94103
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 27835 invoked from network); 18 Jun 2016 04:56:54 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 18 Jun 2016 04:56:54 -0000
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.193 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.220.193 mail-qk0-f193.google.com  
Received: from [209.85.220.193] ([209.85.220.193:33955] helo=mail-qk0-f193.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id D8/31-18862-494D4675 for <internals@lists.php.net>; Sat, 18 Jun 2016 00:56:53 -0400
Received: by mail-qk0-f193.google.com with SMTP id j2so14880501qkf.1
        for <internals@lists.php.net>; Fri, 17 Jun 2016 21:56:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date:message-id
         :subject:to:cc;
        bh=E3CTCD9txDtAPi0iTfvzEZwI1VWJ959fuIp2MU+N9bw=;
        b=OA7Wp8LpnUXvazAfJ2Bw+HYgSxH9vbV4z5G5vpyKaBQ6EUmCBOQsb/ZhnE3VNbpw+7
         s4DAmT69foZ4kgGHYkqelWSpyCVjWDL/jcD4j/bRPzo8/9Yx+9WvBpDisN0eX7Kuwx5g
         Iz3N4WNjhwo6+kaBciPFY0cdhl87Pi40Gsc4bDcpY14+GDaN+H76bT1VcKM6BDxeaMf2
         dbYGYOJjX4mrbjJyOJQ1fW+QbI/uQTSc43AmaJm4muquX3fvvaGDBGwl/YDa4vvqDF3Z
         jvnprLAueHAY7qW7S1y9/oAhqAv3ygKGTQ5wKHR8rrxRaiUbCRYo1I/oMBvxh2Ir/Nhf
         8GZQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:sender:in-reply-to:references:from
         :date:message-id:subject:to:cc;
        bh=E3CTCD9txDtAPi0iTfvzEZwI1VWJ959fuIp2MU+N9bw=;
        b=bEuJyMWQfpB4C0ljyGg67HTu15OGZI7wkXDJynqbDeSfDnQojzX3uQSG6lJJ/AjbUB
         NnDUOcCZactyw+LFWdXY4wqOm/jJTGwDH4n/vLyhpw7+dOda0zPbEoubomGAWmraAG9o
         9tN/bARkAYiB8gnGtTbFFZeIhlkfaK5Rgn4KJfJnf/tDrkDI0nRwotmadHyAdUzz/66O
         LrooOLjs+FbFd6d07a7ZsYw6Y1yQqw22SPe0NtzJ94RRGnFl+hhYzTm6IRqk8vLJl6YO
         HlnKCIkVOnJuikrNqcMVFON8u/lzKXNijuwaP7THFq34d5osr/WAT9FaD059dh+kn8Cj
         FXZg==
X-Gm-Message-State: ALyK8tJf5ExEBg6p+EbiXIfdOVh/JBFBF5qHC1RyNV8vUhSaA2HPg6GraVj3fSis2o6cYdV7PDVjU6wXJ/i1WA==
X-Received: by 10.55.179.195 with SMTP id c186mr6372897qkf.28.1466225809991;
 Fri, 17 Jun 2016 21:56:49 -0700 (PDT)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.140.17.33 with HTTP; Fri, 17 Jun 2016 21:56:10 -0700 (PDT)
In-Reply-To: <20160617202344.2868F1A80C02@dd1730.kasserver.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
Date: Sat, 18 Jun 2016 13:56:10 +0900
X-Google-Sender-Auth: gZJlyhh6ZJ1nuWucsPJ0qynxnm4
Message-ID: <CAGa2bXaTGr6aZAuQDdtOE6v+D1=AeF_8OHpGeiMhkmdH0rt2ew@mail.gmail.com>
To: Thomas Bley <mails@thomasbley.de>
Cc: michael.vostrikov@gmail.com, 
	"internals@lists.php.net" <internals@lists.php.net>, Stanislav Malyshev <smalyshev@gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] New escaped output operator
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Thomas,

On Sat, Jun 18, 2016 at 5:23 AM, Thomas Bley <mails@thomasbley.de> wrote:
> you can simply add the context to the current output operator:
> <?=html $str ?>
> <?=attr $str ?>
> <?=text $str ?> (=strip_tags)
> <?=js $str ?>
> <?=css $str ?>
We need <?=uri $str ?> in addition. If we adopt this, we must document
clearly that LDAP, SQL, etc are not supported.

I like this idea a lot. Output context is clear and explicit.

We may be better to consider "<?= $str" to be "<?php echo
htmlspecialchars($str)" rather than "<?php echo $str", but this change
would be for PHP 8.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net