Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94682
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.54 as permitted sender)
To: internals@lists.php.net
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <8a39df34-4a23-c496-15f6-20a62d27fc59@gmail.com>
 <CAEDdnaWwUUVV6q1Sh+pXNQEAENXHHbJ=ZPaq4otnpnFPwVD-5A@mail.gmail.com>
 <CAObuZdvy9F3sLu=MArNEvh3ZxFkZ=byb7UbH0Gaw2sx=C0QRzw@mail.gmail.com>
 <CAEDdnaV8Qaoib6=v+NBCYYymtQQgyr28qryJ1dBHhVsXqWu5kA@mail.gmail.com>
 <4920f683-9a4d-7153-b157-a7d7ce8cbfe7@gmail.com>
 <933449d0-90c2-0d7a-cb80-a171289d8286@texthtml.net>
 <CAGovj_PiUjJmAncZjrtTiJmBTmuwA1MgfpjwpkKWdp_NHPekpw@mail.gmail.com>
 <CAEDdnaWEwNH-+kOxPk2GDqRod90kOqbT1yGHkOMqx5L9AXRaLA@mail.gmail.com>
 <CAEDdnaVrAvMHzj=bxhp9fOEFRgJ3rY9Tn9XP0oPfYZ0EU-RrjA@mail.gmail.com>
 <20160724145557.D52C31A80BBD@dd1730.kasserver.com>
 <6cfac572-9982-87f8-5a55-9213d978cde9@gmx.de>
 <20160724162103.BC5741A83512@dd1730.kasserver.com>
Message-ID: <b9626a75-f1aa-e420-123c-495b5a6fffc5@gmail.com>
Date: Sun, 24 Jul 2016 17:39:05 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <20160724162103.BC5741A83512@dd1730.kasserver.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: rowan.collins@gmail.com (Rowan Collins)

On 24/07/2016 17:21, Thomas Bley wrote:
>>   <?* $str ?>
>>
>> instead of
>>
>>   <?=h($str)?>
> benefits are using static code analyzers, grep "<?=" for code reviews, etc.

It's not that difficult to write a static analyser that detects 
instances of "<?=" not followed by "h(" or "e(" or whatever.


> Having function names with single characters is bad taste and only useful for obfuscating.

And having a token "*" that calls a different function in every 
application is somehow less obfuscated?


> Using multiple frameworks or libraries, it's not possible to redeclare functions with the same name.

It's not possible for multiple frameworks or libraries to declare 
different escape handlers in your proposal, either.


> The big difference is:
> With <?*, you have to define an escaping function, with <?= it's optional.

You could equally say, "with <?=e()?> you have to define an e() 
function". The main effort is remembering to use the right syntax, which 
you have to do either way.

Surely the feature gets most of its value from what you *don't* need to 
do - which is why I think it's bizarre that the current version doesn't 
even have a built-in HTML escaper at all.

Regards,
-- 
Rowan Collins
[IMSoP]