Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94777
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.18 as permitted sender)
To: Michael Vostrikov <michael.vostrikov@gmail.com>,
 PHP Internals <internals@lists.php.net>
References: <CAEDdnaXH-PuRawcXUuS_pSH8jwVsH=0MLCvnfHJVsUVEwTz0AA@mail.gmail.com>
Message-ID: <905a2505-fc4d-0c54-9d6e-73b69d96d259@gmx.de>
Date: Mon, 1 Aug 2016 14:25:36 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAEDdnaXH-PuRawcXUuS_pSH8jwVsH=0MLCvnfHJVsUVEwTz0AA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [RFC][VOTE] New operator (short tag) for context-dependent
 escaping
From: cmbecker69@gmx.de (Christoph Becker)

On 30.07.2016 at 17:09, Michael Vostrikov wrote:

> Hello. The RFC 'New operator (short tag) for context-dependent escaping' is
> now in voting phase.
> 
> https://wiki.php.net/rfc/escaping_operator

I just checked out the cde_new branch to verify the behavior of some
potential edge cases, but after building I've got segfaults even for

  sapi/cli/php -n -r ""

That's not a problem per se, as the RFC process doesn't even require an
implementation before voting. :-)  Being able to play around with an
implementation would be unlikely to change my vote anyway.

My *main* issue with this RFC is that I don't consider it to enhance
security.  Forgetting to call the proper escaping function is as easy as
forgetting to use <?* instead of <?= or calling an inappropriate
escape_handler_call().

-- 
Christoph M. Becker