Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94615
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <6cffa6e9-b3b7-cedf-ccb7-cb342c768a4f@rochette.cc>
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <CAEDdnaVtb8eboyNpr8CjzysHvKiG26bHPy7eiH76PVMPrYNW+A@mail.gmail.com>
 <CADqTB_jV9-SQmLknWoXx_uC5ThHynSfqcTdUC+E2TwirOpXR8g@mail.gmail.com>
 <CAOsHV+ujFjKP8AL+R171pFTPnwfN2nC7_TViD=qZtOVGEDyebA@mail.gmail.com>
 <CAEDdnaVFzxq5PEXMAkuAYWg9zeL4yWz2pLpv6RyCcB-rvZJ_RA@mail.gmail.com>
 <CAEDdnaUJ4y_1+hVY6cguRivZnvQTCt0=rhVz=nJSPkqJ7aASuA@mail.gmail.com>
 <CAEDdnaV_awP5g4Ee-acVxd7+LYWot2K0-ZEUbWCzc6me5vAFmw@mail.gmail.com>
 <CABdc3WoyJUGSE688S2A_wh064bgmdkPMKgRM31T56pex5Xry+w@mail.gmail.com>
 <CAEDdnaVqzP6oOjcQWWNGenYHgJtNDvCgi_J-y-fsr_bFv3FW9g@mail.gmail.com>
 <CABdc3WrwCcWzbmJC+JRZqZ0HcHj2pDeEO9MfdLUz5V23TGrGRQ@mail.gmail.com>
 <CABdc3WpGYg5t=WRJP0+Z28qfXJ2A+w-7qQC86umCWwFX+hoRcw@mail.gmail.com>
 <CAEDdnaX0-iOcA5PEEqx_nnt1ASMjt_hU1959O69eMoFHZdUH-w@mail.gmail.com>
 <CAObuZdv+UJsSLeNAPf5s5AXh0sMHG+VG9Ai=5m5y2tu9h6vZAA@mail.gmail.com>
 <CAEDdnaUfdUvqKR6jqpoC8Z65VXHSSY6K1buAeT94cdsJHy3-HA@mail.gmail.com> <6cffa6e9-b3b7-cedf-ccb7-cb342c768a4f@rochette.cc>
Date: Thu, 21 Jul 2016 19:24:21 +0500
Message-ID: <CAEDdnaWA9-uyjGbBsRA7PEMna3qiQacrUyXkdzfo00H2eLq=kQ@mail.gmail.com>
To: Mathieu Rochette <mathieu@rochette.cc>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=94eb2c06266afc781705382612f9
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: michael.vostrikov@gmail.com (Michael Vostrikov)

--94eb2c06266afc781705382612f9
Content-Type: text/plain; charset=UTF-8

> I suppose you mean that <?= $row['data'] ?> is the unsafe variant.
> How does this rfc makes it not "works good" ? people will still have to
think escaping their data.
It suggests a way when safe variant is as easy as unsafe, without any
additional code. Of course, unsafe variant cannot be removed because of
backward compatibility. But in new code it will not be used so often as
now, it will be used maybe in 1-2% cases, and old code gradually can be
rewritten with new operator.

> and what it might look like with function autoloading: <?=
html($row['data']) ?>
> that's why people here are talking about function autoloading
As I understand, function autoloading cannot load $this->html(). In this
example it can load MyClass::html() or MyNamespace\html(), but not
$object->html(). And it does not solve the problem with repeating the same
action, and the problem with security when this action will be missed.
This is not a problem to create one global function for escaping. The
problem is to write it everywhere.


> htmlspecialchars + json_encode is the correct way to encode a javascript
string inside an html page
Yes, it is written there exactly as you said:
alert(<?= htmlspecialchars(json_encode($thing['name']), ENT_QUOTES) ?>);

Initially my goal was just an operator for HTML escaping. I tried to show
that this is frequently used context.
I added a work with other contexts because, as I understood, their support
is required for such an operator.
If it will be just for HTML escaping, there will not be a problem with
global state.

Also I think, it is possible to remove a registry and PHPEscaper class and
make only set_escape_hanlder() and restore_escape_handler(), exactly as
set_error_handler(). Will this be more appropriate variant?
This can be used for [$this, 'escape'] or ['MyEscaper', 'escape'] callables.
I just wanted to create a tool ready for use.


> I was think about something like that instead:
> <?[$escaper...]= $data ?>

One of main reasons for creating this RFC is to have default HTML escaping.
Copy-paste is a wrong approach.
Without automatic escaping there is no reason to change the language syntax.

--94eb2c06266afc781705382612f9--