Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94163
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.178 as permitted sender)
User-Agent: K-9 Mail for Android
In-Reply-To: <CAEDdnaUQC5eL2a2gFKjiE9GiJbrpf19Ky7JBop3FEPtncRUwAQ@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com> <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com> <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com> <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com> <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com> <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com> <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com> <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com> <d2cae49a-1b7d-0d18-29eb-08b58889f2a2@gmail.com> <CADqTB_j_BdXHPzd-fkmtSTL8ZCSR3XCgfGO+8nd_2YTkJzd+tQ@mail.gmail.com> <57680CF5.2070003@lsces.co.uk> <CADqTB_gvmqpKvqRsAOGuCWFymowaxLSwzCeNt+UpBdtbep_k6Q@mail.gmail.com> <CANUQDCg0XXsetUAwT18kX5p1eeMk_e2XCEmZj9dGoFr9keRtPA@mail.gmail.com> <CAEDdnaUQC5eL2a2gFKjiE9GiJbrpf19Ky7JBop3FEPtncRUwAQ@mail.gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
 charset=UTF-8
Date: Mon, 20 Jun 2016 23:00:13 +0100
To: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <C86BDEA4-5042-4991-B691-43B84DF83C6C@gmail.com>
Subject: Re: [PHP-DEV] New escaped output operator
From: rowan.collins@gmail.com (Rowan Collins)

On 20 June 2016 17:40:05 GMT+01:00, "Михаил Востриков" <michael.vostrikov@gmail.com> wrote:
>Actually, htmlspecialchars() is needed in all three cases:
...
>You may not write htmlspecialchars together with urlencode just because
>urlencode encodes all special characters with its own way.

So, not needed in all 3 cases then...


>Imagine that urlencode does not encode quotes - what function should we
>call for its result?

Ideally, an escape filter that performs both functions; if the aim is to make things easier, I shouldn't need to think about the need to nest two escape functions. If I still have to use non-obvious combinations of magic syntax plus function calls, the claim of "secure by default" doesn't really stand up. The ~ becomes nothing more than an alias that I still need to remember when to deploy.

<script>$('[data-thing-id="<?~ $thing['name'] ?>]').on('click', function(){doThing('<?~ $thing['name'] ?>'});</script>

I'm pretty sure the tempting syntax is actively harmful in that situation...

>The fact itself, that there were many discussions about it, indicates
>that
>it is a necessary feature.

Popularity is not the same thing as necessity. More relevantly, even when we agree on the problem, the simple solution isn't always the best, sometimes it pays to think a bit more broadly about the problem space. Larry's escaper registration is one example of that.

HackLang's XHP is another - rather than thinking about escaping as an action, it gives the compiler richer knowledge of the structure, so it can "know" the right escape syntax. If the compiler could look at my previous example and recognise the attribute, URL, script, and text contexts itself, then you really would have security-by-default. Unfortunately, that too is tricky to generalise - what is the correct escape method for an attribute named "data-my-action"...?

Regards,

-- 
Rowan Collins
[IMSoP]