Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94140
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
 <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com> <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com>
Date: Mon, 20 Jun 2016 08:22:47 +0500
Message-ID: <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com>
To: Walter Parker <walterp@gmail.com>
Cc: Scott Arciszewski <scott@paragonie.com>, Lester Caine <lester@lsces.co.uk>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114f9f7af8dfa60535ad3759
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--001a114f9f7af8dfa60535ad3759
Content-Type: text/plain; charset=UTF-8

> "Use '<?~' and it will solve your XSS and other escaping problems with
outputting HTML that was stored in a DB."
I don't think this is a good phrase for documentation. This form should be
considered exactly as htmlspecialchars, with taking into account any
language and encoding-specific issues, and this should be pointed in
documentation. This is a shorcut for often operation, like '??' for isset()
check. And it can really improve security, not in 90% but about 99.9999%
cases.

2016-06-20 4:41 GMT+05:00 Walter Parker <walterp@gmail.com>:

>
>>
>> > where getting it 90% correct is worse that not doing anything at all.
>> > Things like this will cause people to be blindsided when the uncaught
>> escapes
>> > cause the next major security problem.
>>
>> Why do you think so? What real problems can happen if there will be a
>> short operator for htmlspecialchars()?
>>
>> What could happen is this getting sold/documented as a general purpose
> security feature:
> "Use '<?~' and it will solve your XSS and other escaping problems with
> outputting HTML that was stored in a DB."  What it solves is a subset,
> which is escaping characters stored in a data that have special meanings to
> HTML. My concern is that the remain security issues might get overlooked or
> ignored because '<?~' is considered good enough. There are issues with
> htmlspecialchars, UTF-8 and certain language-specific characters (non
> English). There were also issues with quotes in the past.
>
>
> Walter
>

--001a114f9f7af8dfa60535ad3759--