Re: RFC: Implementing a core anti-XSS escaping class
| From: | Stas Malyshev | Date: | Tue, 18 Sep 2012 17:09:14 +0000 |
| Subject: | Re: RFC: Implementing a core anti-XSS escaping class | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-63074@lists.php.net to get a copy of this message | ||
Hi!
> No it's not. A filter removes, but escaping lets the original content
> pass through unchanged, with the necessary in-band signalling to make
> sure that its content is not treated as in-band signalling.
Again, you are confusing particular implementation of a particular
filter with the idea of filtering. Moreover, even existing filters do
not match your description:
FILTER_SANITIZE_ENCODED, FILTER_SANITIZE_MAGIC_QUOTES,
FILTER_SANITIZE_SPECIAL_CHARS, FILTER_SANITIZE_FULL_SPECIAL_CHARS,
FILTER_SANITIZE_STRING, FILTER_CALLBACK
But in general, look at implementation of filters anywhere - like Apache
filters or IIS filters - nowhere it is said that filter can only remove
data.
--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227