# New operator for htmlspecialchars

- Thread: https://externals.io/message/64974
- Original archive: https://news-web.php.net/php.internals/64974
- Started by Thomas Bley on 2013-01-15T21:22:14+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #64974 — Thomas Bley — 2013-01-15T21:22:14+00:00

URL: https://externals.io/message/64974#64974

Hello,

I created a small ticket to propose a shorter syntax for htmlspecialchars:

old:
<?= htmlspecialchars($str, ENT_QUOTES) ?>

new:
<?+ $str ?>
or:
<?~ $str ?>

any comments, pros and cons?

https://bugs.php.net/bug.php?id=62574

Best regards,
Thomas

---

## #64979 — David Muir — 2013-01-15T22:24:38+00:00

URL: https://externals.io/message/64974#64979 · In reply to: #64974

> Hello,
>
> I created a small ticket to propose a shorter syntax for htmlspecialchars:
>
> old:
> <?= htmlspecialchars($str, ENT_QUOTES) ?>
>
> new:
> <?+ $str ?>
> or:
> <?~ $str ?>
>
> any comments, pros and cons?
>
> https://bugs.php.net/bug.php?id=62574
>
> Best regards,
> Thomas
>

The problem here is that htmlspecialchars only covers html body, and not 
html attributes, or other contexts (eg js, css, urls).

You're better off using something like Zend\Escaper, or Symfony's escaper.

The escaper RFC also gives a good amount of detail:
https://wiki.php.net/rfc/escaper

As for the shorter syntax with automatic output, I think it makes the 
code harder to read.

Cheers,
David

---

## #64988 — Stas Malyshev — 2013-01-16T02:21:59+00:00

URL: https://externals.io/message/64974#64988 · In reply to: #64974

Hi!

> Hello,
> 
> I created a small ticket to propose a shorter syntax for htmlspecialchars:
> 
> old:
> <?= htmlspecialchars($str, ENT_QUOTES) ?>

Don't think operator can make sense here, since you can have different
options, etc. depending on context. But you could do this if the above
is too long for you:

function _h($str) {
  return htmlspecialchars($str, ENT_QUOTES);
}

...

<?= _h($str); ?>

Not much longer than operator, much clearer and does not require
language syntax to be linked to some specific options in some specific
function.

-- 
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227