Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94677
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.52 as permitted sender)
To: internals@lists.php.net
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <8a39df34-4a23-c496-15f6-20a62d27fc59@gmail.com>
 <CAEDdnaWwUUVV6q1Sh+pXNQEAENXHHbJ=ZPaq4otnpnFPwVD-5A@mail.gmail.com>
 <CAObuZdvy9F3sLu=MArNEvh3ZxFkZ=byb7UbH0Gaw2sx=C0QRzw@mail.gmail.com>
 <CAEDdnaV8Qaoib6=v+NBCYYymtQQgyr28qryJ1dBHhVsXqWu5kA@mail.gmail.com>
 <4920f683-9a4d-7153-b157-a7d7ce8cbfe7@gmail.com>
 <933449d0-90c2-0d7a-cb80-a171289d8286@texthtml.net>
 <CAGovj_PiUjJmAncZjrtTiJmBTmuwA1MgfpjwpkKWdp_NHPekpw@mail.gmail.com>
 <CAEDdnaWEwNH-+kOxPk2GDqRod90kOqbT1yGHkOMqx5L9AXRaLA@mail.gmail.com>
 <CAEDdnaVrAvMHzj=bxhp9fOEFRgJ3rY9Tn9XP0oPfYZ0EU-RrjA@mail.gmail.com>
Message-ID: <5a59b510-02fc-3f00-9da6-0507a8a3d3f5@gmail.com>
Date: Sun, 24 Jul 2016 15:40:05 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAEDdnaVrAvMHzj=bxhp9fOEFRgJ3rY9Tn9XP0oPfYZ0EU-RrjA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: rowan.collins@gmail.com (Rowan Collins)

On 24/07/2016 10:48, Michael Vostrikov wrote:
> Operator is compiled into the following AST:
> echo escape_handler_call(first_argument, second_argument);

I'm sorry, but this is now so simple it undermines its own argument for 
existing.



> There is no default handler for any context, to
> prevent 'built-in' wrong work of <?* $str ?> constructions in non-HTML
> contexts like CSV. This is not hard to create a handler once. Default
> context can be set in it as default value for second argument.

So it is now mandatory to have some bootstrap file somewhere that 
defines and registers the escape function? How is that different from 
writing, right now, at the top of your bootstrap file:

function e($str, $context = 'html') {
...
}

You are effectively offering a way of aliasing a particular function to 
the magic name "*", and everything else is still down to the user.


> Complicated syntax like <?*html*js= $str ?>.

I have no idea why that is "complicated syntax", but your proposal isn't:

<?: $str | 'html | js' ?>

Or even:

<?: $str | ['html', 'js'] ?>

In your proposal, part of the syntax won't even be standard between 
different people's code (and yes, the '|' in 'html | js' is syntax, even 
if it's not parsed until run-time).

Is it just that you don't like the escape strategy coming first? I 
suggested it that way just to make it stand out more, but this would be 
entirely equivalent (assuming we could find an appropriate separator):

<?* $str : html : js ?>



> If we allow custom handlers, then we need runtime processing, so the
> example above cannot be compiled into
> <?= htmlspecialchars(json_encode($str)) ?>
> directly, and it will something like
> <?= escape_handler_call(escape_handler_call($str, 'html'), 'js') ?>

Yes, this is exactly how all template languages I've ever seen do it. 
Once you unroll the if / switch / lookup table, the code run under your 
proposal would be something like this:

$temp = $str;
$temp = json_encode($temp);
$temp = htmlspecialchars($temp);

I don't really see how one is any better than the other.


> I.e. we anyway need to pass context as a second argument, so why not allow
> user to do it.

Because we're trying to make it easier for the user, not harder. Why 
make them handle the nesting, sanity-checking, and control flow of 
multiple filters, rather than building them into the syntax from the start?

Regards,

-- 
Rowan Collins
[IMSoP]