Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94351
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <7fb2d4d0-551e-97a0-72cd-1b6401881f97@fischer.name>
References: <20160620222835.BC26C1A80609@dd1730.kasserver.com>
 <14352177-1b49-e2ed-56a3-9a770d0ebf95@gmail.com> <CAEDdnaU35=jGotCRVHx8=i7JnTg7yZOffr4dZtTDJ9vhqTNqtw@mail.gmail.com>
 <CAEDdnaUo=QwDejnJ64ziY2i-9KbMBgvN-_T7pzR8FfXBK3QHQA@mail.gmail.com>
 <CAEDdnaWUNpPxnwymdCj5hrOD=P01BmYO+xJD5JHTy98TRHaLuA@mail.gmail.com>
 <CAObuZduaythsvKtLj=vQtwZX9J_ZjQtywPES+K58-6YoK850zw@mail.gmail.com>
 <CAEDdnaX_hpKEv_ei-f7kWewyE3QB3d9Z=4qApqFhdBRSVFUtWw@mail.gmail.com> <7fb2d4d0-551e-97a0-72cd-1b6401881f97@fischer.name>
Date: Fri, 1 Jul 2016 13:51:53 +0500
Message-ID: <CAEDdnaUBv09R5MfD9X1LRhnmYz2qopdEWyrB3LfQncyrU3HtXw@mail.gmail.com>
To: Markus Fischer <markus@fischer.name>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c065bfe3b6cbf05368f192b
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--94eb2c065bfe3b6cbf05368f192b
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

> I can easier add a new template to e.g. a Laravel
> project (own parser, own extension, living next to existing blade
templates)

Your project already has a template engine, and framework has common code
which works with such engines.
But how much time do you need to convert all existing templates to a new TE=
?

I mean the projects without template engine, which work and are developed
every day.
Their number is rather large - various CMSs, projects with custom core, Yii
and Zend don't have TE by default.
In a big project there are a lot of PHP templates with <?=3D htmlspecialcha=
rs
?> or <?=3D h() ?> or <?=3D (int)$some_id ?> everywhere.
If we miss this somewhere, we could got an XSS.


2016-07-01 12:53 GMT+05:00 Markus Fischer <markus@fischer.name>:

> On 01.07.16 05:34, =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=92=D0=BE=D1=
=81=D1=82=D1=80=D0=B8=D0=BA=D0=BE=D0=B2 wrote:
> > Because it is almost impossible to add template engine in a big project
> > with PHP templates. But new version of language usually can easily be
> used.
>
> I interpret "But new version of language usually can easily be used" as
> in a new PHP version being installed on a server touted as being
> "easier" than changing/replaced/adding a new template language component
> with a framework?
>
> I object to this. I can easier add a new template to e.g. a Laravel
> project (own parser, own extension, living next to existing blade
> templates) then switching to a new PHP version on production servers.
>
> - Markus
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--94eb2c065bfe3b6cbf05368f192b--