Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94113
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com> <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
Date: Sun, 19 Jun 2016 13:38:29 +0500
Message-ID: <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
To: Marco Pivetta <ocramius@gmail.com>
Cc: Niklas Keller <me@kelunik.com>, Rasmus Schultz <rasmus@mindplay.dk>, 
	Ryan Pallas <derokorian@gmail.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	Thomas Bley <mails@thomasbley.de>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c0cbf1a26f36a05359d83bd
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--94eb2c0cbf1a26f36a05359d83bd
Content-Type: text/plain; charset=UTF-8

Guys, wait please) I don't suggest escaping package for all contexts and
for all cases. This is not what I described in my first letter. My point is
that the main job of echo operator "<?= ?>" is output an unknown value from
database to an HTML environment. So in all this places we should copy-pase
the call of htmlspecialchars() to prevent XSS. There are many projects
which is written on custom engines, or frameworks, or CMS, and they does
not have any templating engine, and there is no possibility to rewrite many
working PHP templates to Twig, or Smarty, or something else.

I suggest new simple operator "<?~ ?>" which will automatically wrap the
output value in htmlspecialchars(). It is intended specially for HTML, not
for XML or JS. It does not require any php.ini settings, new classes or
constants. The reason for implementing it is the same as for implementing
"??", or "<=>", or "<?= ?>" operators - make better usual and often
operations, descrease copy-paste, and increase security. I can implement it
myself and send a patch.

What do you think?


2016-06-19 12:59 GMT+05:00 Marco Pivetta <ocramius@gmail.com>:

> On 19 June 2016 at 09:53, Niklas Keller <me@kelunik.com> wrote:
>
>> Rasmus Schultz <rasmus@mindplay.dk> schrieb am Sa., 18. Juni 2016, 17:44:
>>
>> Did you know that you can alias namespaces, too?
>>
>> <?php use My\Stuff\Escape as esc; ?>
>> <?=esc\html($str)?>
>>
>> You can always add more functions to a namespace even spread accross
>> multiple files.
>>
>
> Pro-userland: quick reminder that a `composer update` is much quicker than
> a full system PHP version upgrade.
>
> I'd rather rely on an escaping package written in PHP, easier to maintain
> and quicker to upgrade, than something that will likely use some obscure
> shared library (or the PHP binary itself) that may not be upgraded for
> weird reasons (it's shared, remember?).
>
> I know that you put a lot of effort in security maintenance, but it's
> still easier to deal with this stuff in userland in any case, and most
> templating languages in common frameworks already inject helpers in the
> script context in order to achieve quick, effective and context-aware (no
> automatic context detection) escaping.
>
> Marco Pivetta
>
> http://twitter.com/Ocramius
>
> http://ocramius.github.com/
>
>

--94eb2c0cbf1a26f36a05359d83bd--