[RFC] Escaping RFC for PHP Core - Updates? View as Markdown

On Sat, 07 Sep 2013 20:08:45 +0400, Michael John Burgess <
michael@mjburgess.co.uk> wrote:

It looks nicer than Escaper::escapeJs(), Escaper::escapeHtml(), etc.

Any comments?

Please, don't go down this route. You do not want one class to escape all
kinds of data; delegate each type of escaping to its own class:

JavaScriptEscaper->escape();
PhpEscaper->escape();
HtmlEscaper->escape();
HtmlAttributeEscaper->escape()**;

I should not have to defend this but I am willing to explain in more
detail
if someone would like me to.

There doesnt need to be any object-oriented version for this problem.
It's a series of pure functions. Wraping them in one or more classes adds
nothing.

Michael

Hi,

Wrapping those functions in methods means they can be extended in child
classes. So suppose you have some library that takes object of type
Spl_Escaper and uses its methods for escaping some data. Now if you will
need some additional escaping you just need to make child class for
Spl_Escaper and override methods which behavior you need to change. This
can't be done with pure functions (in PHP).

You have a flawed understanding of good functional design. Instead of
directly calling the escaping function you would simply ask for a callable
and pass in the escaping function. Thus, you could use an alternative
escaping function at runtime.

The methods route is a poor choice. If we use classes at all, separate the
responsibility of each type of escaping to a separate class. Escaping JSON
and HTML code have little (possibly nothing) in common and do not belong in
the same class.

How about allowing to register a custom escape function for each type
which can override the native one or the previous registered one?
There should be no way to restore a previous user registered function
but there should be a way to reset it to the internal php one. That
would solve the described problem as well as keeping it simple.
And having this as a class doesn't add anything imho, mainly due to
the point described above by Levi.

Kind regards

Florin Patan
https://github.com/dlsniper
http://www.linkedin.com/in/florinpatan

Hi,

On Sun, Sep 8, 2013 at 1:43 AM, Levi Morrison morrison.levi@gmail.comwrote:

You have a flawed understanding of good functional design. Instead of
directly calling the escaping function you would simply ask for a callable
and pass in the escaping function. Thus, you could use an alternative
escaping function at runtime.

The methods route is a poor choice. If we use classes at all, separate the
responsibility of each type of escaping to a separate class. Escaping JSON
and HTML code have little (possibly nothing) in common and do not belong in
the same class.

You are proposing something like

$escape_function = function($input) {
$output=avaScriptEscaper->escape($input);
$output=do_some_additional($output);
return $output;
}

my_escape($some_data, $escape_function) {
return $escape_function($some_data);
}

Is this correct?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net