Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94683
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.21 as permitted sender)
To: Thomas Bley <mails@thomasbley.de>, internals@lists.php.net,
 michael.vostrikov@gmail.com
References: <CAEDdnaWVYbh=t1-bvDh9fixCoC7Be4asoEus=dRhGggx_9VLNg@mail.gmail.com>
 <8a39df34-4a23-c496-15f6-20a62d27fc59@gmail.com>
 <CAEDdnaWwUUVV6q1Sh+pXNQEAENXHHbJ=ZPaq4otnpnFPwVD-5A@mail.gmail.com>
 <CAObuZdvy9F3sLu=MArNEvh3ZxFkZ=byb7UbH0Gaw2sx=C0QRzw@mail.gmail.com>
 <CAEDdnaV8Qaoib6=v+NBCYYymtQQgyr28qryJ1dBHhVsXqWu5kA@mail.gmail.com>
 <4920f683-9a4d-7153-b157-a7d7ce8cbfe7@gmail.com>
 <933449d0-90c2-0d7a-cb80-a171289d8286@texthtml.net>
 <CAGovj_PiUjJmAncZjrtTiJmBTmuwA1MgfpjwpkKWdp_NHPekpw@mail.gmail.com>
 <CAEDdnaWEwNH-+kOxPk2GDqRod90kOqbT1yGHkOMqx5L9AXRaLA@mail.gmail.com>
 <CAEDdnaVrAvMHzj=bxhp9fOEFRgJ3rY9Tn9XP0oPfYZ0EU-RrjA@mail.gmail.com>
 <20160724145557.D52C31A80BBD@dd1730.kasserver.com>
 <6cfac572-9982-87f8-5a55-9213d978cde9@gmx.de>
 <20160724162103.BC5741A83512@dd1730.kasserver.com>
Message-ID: <efdfdd99-77d9-f722-7000-13b4528dd77c@gmx.de>
Date: Sun, 24 Jul 2016 18:52:32 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <20160724162103.BC5741A83512@dd1730.kasserver.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] New operator for context-dependent escaping
From: cmbecker69@gmx.de (Christoph Becker)

On 24.07.2016 at 18:21, Thomas Bley wrote:

>>  <?* $str ?>
>>
>> instead of
>>
>>  <?=h($str)?>
> 
> benefits are using static code analyzers, grep "<?=" for code reviews, etc.

Well, something like `grep -P <\?=(?!h[(])` seems to be a viable
alternative.

> Having function names with single characters is bad taste and only useful for obfuscating.

Cryptic "operators", however, are not?

> The big difference is:
> With <?*, you have to define an escaping function, with <?= it's optional.

But you still have to rember to use <?* instead of <?= and use the
proper escaping function.

Actually, I'm not really interested in discussing the current RFC (the
discussion is already rather lengthy, and has started to go in circles
long ago).  I just wanted to give an explanation why I would vote
against it.

-- 
Christoph M. Becker