Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94127
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20160619160904.BEC561A80644@dd1730.kasserver.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com> <20160619160904.BEC561A80644@dd1730.kasserver.com>
Date: Sun, 19 Jun 2016 21:53:32 +0500
Message-ID: <CAEDdnaX759Tdp4AdgzcHTk5r4YagsNC5mRZRVUcgbhT0NL_fGA@mail.gmail.com>
To: Thomas Bley <mails@thomasbley.de>
Cc: Marco Pivetta <ocramius@gmail.com>, Niklas Keller <me@kelunik.com>, 
	Rasmus Schultz <rasmus@mindplay.dk>, Ryan Pallas <derokorian@gmail.com>, 
	Stanislav Malyshev <smalyshev@gmail.com>, internals@lists.php.net
Content-Type: multipart/alternative; boundary=94eb2c0578d09b37190535a46dbb
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--94eb2c0578d09b37190535a46dbb
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Please give me RFC karma. My wiki account is "michael-vostrikov". I plan to
create an RFC for this feature.

2016-06-19 21:09 GMT+05:00 Thomas Bley <mails@thomasbley.de>:

> I think it's best to create a rfc and put it to vote:
> https://wiki.php.net/rfc/howto
>
> Having <?~ makes it a lot easier to do code reviews.
> I also think majority of use cases is <?~, other parts can use
> json_encode(), filter_var() and other filters/escapers.
>
> Regards
> Thomas
>
> =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=92=D0=BE=D1=81=D1=82=D1=80=D0=B8=
=D0=BA=D0=BE=D0=B2 wrote on 19.06.2016 10:38:
>
> > Guys, wait please) I don't suggest escaping package for all contexts an=
d
> > for all cases. This is not what I described in my first letter. My poin=
t
> is
> > that the main job of echo operator "<?=3D ?>" is output an unknown valu=
e
> from
> > database to an HTML environment. So in all this places we should
> copy-pase
> > the call of htmlspecialchars() to prevent XSS. There are many projects
> > which is written on custom engines, or frameworks, or CMS, and they doe=
s
> > not have any templating engine, and there is no possibility to rewrite
> many
> > working PHP templates to Twig, or Smarty, or something else.
> >
> > I suggest new simple operator "<?~ ?>" which will automatically wrap th=
e
> > output value in htmlspecialchars(). It is intended specially for HTML,
> not
> > for XML or JS. It does not require any php.ini settings, new classes or
> > constants. The reason for implementing it is the same as for implementi=
ng
> > "??", or "<=3D>", or "<?=3D ?>" operators - make better usual and often
> > operations, descrease copy-paste, and increase security. I can implemen=
t
> it
> > myself and send a patch.
> >
> > What do you think?
> >
>
>

--94eb2c0578d09b37190535a46dbb--