Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94596
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAObuZdv+UJsSLeNAPf5s5AXh0sMHG+VG9Ai=5m5y2tu9h6vZAA@mail.gmail.com>
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <CADqTB_ikRepsbO_9vhw568=SaypdPh-z+FzOEr4yji1LibVbjQ@mail.gmail.com>
 <CAEDdnaVtb8eboyNpr8CjzysHvKiG26bHPy7eiH76PVMPrYNW+A@mail.gmail.com>
 <CADqTB_jV9-SQmLknWoXx_uC5ThHynSfqcTdUC+E2TwirOpXR8g@mail.gmail.com>
 <CAOsHV+ujFjKP8AL+R171pFTPnwfN2nC7_TViD=qZtOVGEDyebA@mail.gmail.com>
 <CAEDdnaVFzxq5PEXMAkuAYWg9zeL4yWz2pLpv6RyCcB-rvZJ_RA@mail.gmail.com>
 <CAEDdnaUJ4y_1+hVY6cguRivZnvQTCt0=rhVz=nJSPkqJ7aASuA@mail.gmail.com>
 <CAEDdnaV_awP5g4Ee-acVxd7+LYWot2K0-ZEUbWCzc6me5vAFmw@mail.gmail.com>
 <CABdc3WoyJUGSE688S2A_wh064bgmdkPMKgRM31T56pex5Xry+w@mail.gmail.com>
 <CAEDdnaVqzP6oOjcQWWNGenYHgJtNDvCgi_J-y-fsr_bFv3FW9g@mail.gmail.com>
 <CABdc3WrwCcWzbmJC+JRZqZ0HcHj2pDeEO9MfdLUz5V23TGrGRQ@mail.gmail.com>
 <CABdc3WpGYg5t=WRJP0+Z28qfXJ2A+w-7qQC86umCWwFX+hoRcw@mail.gmail.com>
 <CAEDdnaX0-iOcA5PEEqx_nnt1ASMjt_hU1959O69eMoFHZdUH-w@mail.gmail.com> <CAObuZdv+UJsSLeNAPf5s5AXh0sMHG+VG9Ai=5m5y2tu9h6vZAA@mail.gmail.com>
Date: Thu, 21 Jul 2016 00:55:39 +0500
Message-ID: <CAEDdnaUfdUvqKR6jqpoC8Z65VXHSSY6K1buAeT94cdsJHy3-HA@mail.gmail.com>
Cc: PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c06266afa8425053816951d
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: michael.vostrikov@gmail.com (Michael Vostrikov)

--94eb2c06266afa8425053816951d
Content-Type: text/plain; charset=UTF-8

> <?= $this->escapeHtml($value); ?>
> I don't see what is hard in using that syntax, plus it's not a global
registry.
> if people aren't using templating and haven't written any of their own
wrappers to sanitize the output

They HAVE own wrappers. The problem is that unsafe variant works good, but
unsafe variant should not work good.
The problem is that they have to keep in mind that they need always write a
wrapper, they always need to repeat the same action again. And somewhen
they just miss this and get possible problems with security.
The problem is that this is very frequent case, so we need a tool for this
case, which will prevent wrong work (XSS in particular).

We always perform an output to some context. Why just not to add an easy
tool for work with contexts?
This is just one call - PHPEscaper::escape(). Consider it like a Facade
pattern.


> what's going to drive them to change?

Why then many people are asking about this feature?
In my RFC there are 10 links to similar discussions. They are from those
people who was not lazy to write to mailing list or bug-tracker.
There are also the results of the poll - 286 people are for this operator
(now 320, after I wrote about implementation with contexts).

And in first message I asked about official poll from PHP developers. Why
not conduct it?

--94eb2c06266afa8425053816951d--