Re: RFC: Implementing a core anti-XSS escaping class
| From: | Andrew Faulds | Date: | Tue, 18 Sep 2012 17:03:54 +0000 |
| Subject: | Re: RFC: Implementing a core anti-XSS escaping class | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-63073@lists.php.net to get a copy of this message | ||
On 18/09/12 18:00, Stas Malyshev wrote:
Hi!-- Andrew Faulds http://ajf.me/Filtering is very different from escaping. They each handle similar but unique problems:It is a purely artificial distinction. Filtering is taking one set of data and returning other set of data, it can be applied on input, output, or anywhere you want to. Just because we used filtering for input, does not mean we can't use the same for output, there is absolutely no need to reinvent the wheel just because we're using it in different place now. It is a mistake to think that because we started to use filtering on input data, now the word "filtering" means it should never applied to output and we have to invent whole new API to do the same. No it's not. A filter removes, but escaping lets the original content pass through unchanged, with the necessary in-band signalling to make sure that its content is not treated as in-band signalling.