Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94143
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANaX5ndUCfFOUCdveCxUZN62HYa0VeHi6c1Zj7omDUgoXmrUwg@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
 <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com>
 <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com>
 <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com>
 <CAMPTd_A6YzDDenDp+twULMPRbKRhw408m=XifiRWnC=RG4dxHw@mail.gmail.com> <CANaX5ndUCfFOUCdveCxUZN62HYa0VeHi6c1Zj7omDUgoXmrUwg@mail.gmail.com>
Date: Mon, 20 Jun 2016 09:06:03 +0500
Message-ID: <CAEDdnaXbzxsXDuK==dVAPBm9xj-R=b6Y_7Y-Eak0dP0QzkN8iA@mail.gmail.com>
To: Davey Shafik <davey@php.net>
Cc: Walter Parker <walterp@gmail.com>, Scott Arciszewski <scott@paragonie.com>, 
	Lester Caine <lester@lsces.co.uk>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c06fb2eb2825b0535add298
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--94eb2c06fb2eb2825b0535add298
Content-Type: text/plain; charset=UTF-8

Davey, could you give some example? As I see in this discussion, all
specific use cases are associated with output to JS or URL context. But
this is not a majority of use cases. Also, html escaping should not be used
here, json_encode() or urlencode() should be used instead.

2016-06-20 8:39 GMT+05:00 Davey Shafik <davey@php.net>:

> On Sun, Jun 19, 2016 at 8:30 PM, Walter Parker <walterp@gmail.com> wrote:
>
>> Good, then we do agree, as what I said was what I DID NOT want to see in
>> the documentation.
>>
>> This should be documented as shortcut for <? echo htmlspecialchars(string)
>> ?>. It should be further pointed out that while this will be useful in
>> catching many XSS and other HTML issues, it will not catch all of them, so
>> care and attention to proper data hygiene is still required.
>>
>>
>> Walter
>
>
> There will never be a way to make this operator useful to a majority of
> users or use cases; similar ideas have been discussed many times in the
> past.
>
> If we get annotations then you might be able to hook something in from
> userland transparently that understands your specific context and
> application. This would be much more feasible IMO.
>
> - Davey
>

--94eb2c06fb2eb2825b0535add298--