Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94637
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.193 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <c614b029-1606-d54e-57f2-454cc45e1d37@rochette.cc>
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <8a39df34-4a23-c496-15f6-20a62d27fc59@gmail.com> <CAEDdnaWwUUVV6q1Sh+pXNQEAENXHHbJ=ZPaq4otnpnFPwVD-5A@mail.gmail.com>
 <CAObuZdvy9F3sLu=MArNEvh3ZxFkZ=byb7UbH0Gaw2sx=C0QRzw@mail.gmail.com>
 <CAEDdnaV8Qaoib6=v+NBCYYymtQQgyr28qryJ1dBHhVsXqWu5kA@mail.gmail.com> <c614b029-1606-d54e-57f2-454cc45e1d37@rochette.cc>
Date: Fri, 22 Jul 2016 22:12:58 +0500
Message-ID: <CAEDdnaUgOqh+uqjyRMYvciMuzpx_jPWfGK422nWPGpKQ=mFgwg@mail.gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113d3aace6706105383c8b2c
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: michael.vostrikov@gmail.com (Michael Vostrikov)

--001a113d3aace6706105383c8b2c
Content-Type: text/plain; charset=UTF-8

> I'm conflicted with this one. For you php "More than 90% of output data -
is data from DB and must be HTML-encoded."
> I have no idea how you came with this, even with applications or websites
I'm working on not using a template engine this is far from the truth.
> especially now that more ans more web application are consuming json API,
the backend often produce mostly json & xml.

This is from my experience and from the poll. 35% + 23% people work 'with
the projects with template rendering on PHP
where template engines are not used' always or quite often. And in such
applications there are many constructions like <?= h($entity->property) ?>,
except values with HTML or constructions like <?= json_encode() ?>, which
is quite rare case.
Also, HTML escaping can be used in XML templates.
Of course, for JSON API this operator is useless, as well as for
applications with template engine.


> I don't think "json" escaping should produce an array

JSON is object notation. This is unclear why I wrote <?* ['a' => 'b'],
'json' ?>, but don't get this value encoded in JSON. But you are right, if
array is casted to string, this is escaping.

--001a113d3aace6706105383c8b2c--