Bug #3284: Add syntax extension to allow "htmlspecialchars($foo)" inside quoted strings

From: mike@morearty.com Operating system: FreeBSD PHP version: 3.0.12 PHP Bug Type: Feature/Change Request Bug description: Add syntax extension to allow "htmlspecialchars($foo)" inside quoted strings This would be super, SUPER useful for everyone: a way to automatically expand (both in regular code AND in quoted strings): $|foo [where "|" might be some other special punctuation character; you decide what character would work best] to: htmlspecialchars($foo) Here's why. One of the most common bugs in CGI programming -- in PHP or any other language -- is constructs such as this: echo "<input type=text name=foo value='$foo'> <input type=text name=bar value='$bar'>"; In this case, "$foo" will be expanded. However, there's a serious problem here: if $foo contains any of the special characters (< > & "), those characters will NOT be escaped, and thus the resulting HTML is broken! The correct way to do this is the following mess: echo "<input type=text name=foo value='" . htmlspecialchars($foo) . "'><input type=text name=bar value='" . htmlspecialchars($bar) . "'>"; This is a big pain in the neck. Basically, it means that the automatic expansion of variables inside quoted strings is WAY less useful than it would be otherwise. My proposed syntax extension would make this way, way easier. Here's how you would be able to write the above example: echo "<input type=text name=foo value='$|foo'> <input type=text name=bar value='$|bar'>"; This is MUCH cleaner. Also, this feature would encourage correct code, because without this feature, many programmers frequently forget to call htmlspecialchars() because of the convenience of relying on string-expansion. This extension would also help in other situations, such as these: // if $name == "A&J Market", some browsers // will not display what you want: echo "<p>Company name: $name</p>"; // This is WRONG! echo "<p>Company name: $|name</p>"; // This would be okay // if $email == "Joe Smith <joe@somewhere.com>", // most browsers will not display what you want: echo "Reply to $email"; // This is WRONG! echo "Reply to $|email"; // This would be okay Also, an example when escaping from HTML mode: <form> <!-- this is WRONG: --> <input type=text name=foo value="<? echo $foo ?>"> <!-- this would be okay: --> <input type=text name=foo value="<? echo $|foo ?>"> Note that in any context, $|foo would be an r-value, NOT an l-value (that is, you can't assign to it or pass it by reference). For example, this is illegal: $|foo = "hi"; // illegal