Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94352
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEDdnaUBv09R5MfD9X1LRhnmYz2qopdEWyrB3LfQncyrU3HtXw@mail.gmail.com>
References: <20160620222835.BC26C1A80609@dd1730.kasserver.com>
 <14352177-1b49-e2ed-56a3-9a770d0ebf95@gmail.com> <CAEDdnaU35=jGotCRVHx8=i7JnTg7yZOffr4dZtTDJ9vhqTNqtw@mail.gmail.com>
 <CAEDdnaUo=QwDejnJ64ziY2i-9KbMBgvN-_T7pzR8FfXBK3QHQA@mail.gmail.com>
 <CAEDdnaWUNpPxnwymdCj5hrOD=P01BmYO+xJD5JHTy98TRHaLuA@mail.gmail.com>
 <CAObuZduaythsvKtLj=vQtwZX9J_ZjQtywPES+K58-6YoK850zw@mail.gmail.com>
 <CAEDdnaX_hpKEv_ei-f7kWewyE3QB3d9Z=4qApqFhdBRSVFUtWw@mail.gmail.com>
 <7fb2d4d0-551e-97a0-72cd-1b6401881f97@fischer.name> <CAEDdnaUBv09R5MfD9X1LRhnmYz2qopdEWyrB3LfQncyrU3HtXw@mail.gmail.com>
Date: Fri, 1 Jul 2016 11:18:44 +0200
Message-ID: <CADqioP16NUbB91VE_8-_1NXi=1dCKvHDdjH3AkX0X_SaUxLYmg@mail.gmail.com>
To: =?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?= <michael.vostrikov@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11411574417f0d05368f79f4
Subject: Re: [PHP-DEV] New escaped output operator
From: gen.work@gmail.com (Eugene Leonovich)

--001a11411574417f0d05368f79f4
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 1, 2016 at 10:51 AM, =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=
=92=D0=BE=D1=81=D1=82=D1=80=D0=B8=D0=BA=D0=BE=D0=B2 <
michael.vostrikov@gmail.com> wrote:

> > I can easier add a new template to e.g. a Laravel
> > project (own parser, own extension, living next to existing blade
> templates)
>
> Your project already has a template engine, and framework has common code
> which works with such engines.
> But how much time do you need to convert all existing templates to a new
> TE?
>
> I mean the projects without template engine, which work and are developed
> every day.
> Their number is rather large - various CMSs, projects with custom core, Y=
ii
> and Zend don't have TE by default.
> In a big project there are a lot of PHP templates with <?=3D htmlspecialc=
hars
> ?> or <?=3D h() ?> or <?=3D (int)$some_id ?> everywhere.
> If we miss this somewhere, we could got an XSS.
>
>
> 2016-07-01 12:53 GMT+05:00 Markus Fischer <markus@fischer.name>:
>
> > On 01.07.16 05:34, =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB =D0=92=D0=BE=D1=
=81=D1=82=D1=80=D0=B8=D0=BA=D0=BE=D0=B2 wrote:
> > > Because it is almost impossible to add template engine in a big proje=
ct
> > > with PHP templates. But new version of language usually can easily be
> > used.
> >
> > I interpret "But new version of language usually can easily be used" as
> > in a new PHP version being installed on a server touted as being
> > "easier" than changing/replaced/adding a new template language componen=
t
> > with a framework?
> >
> > I object to this. I can easier add a new template to e.g. a Laravel
> > project (own parser, own extension, living next to existing blade
> > templates) then switching to a new PHP version on production servers.
> >
> > - Markus
> >
> > --
> > PHP Internals - PHP Runtime Development Mailing List
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
> >
>

> In a big project there are a lot of PHP templates with <?=3D
htmlspecialchars
?> or <?=3D h() ?> or <?=3D (int)$some_id ?> everywhere.

How will a new output operator help in this case? You still have to search
for `<?=3D`, `<? echo`, `<? print` occurrences and replace them with `<?~`.
Saying that one can forget to add `<?=3D h()` can be applied to `<?~` as
well, you can miss `<? echo` somewhere in a template and get the same
result at the end.

--=20
Thank you and best regards,
Eugene Leonovich

--001a11411574417f0d05368f79f4--