Re: RFC: Implementing a core anti-XSS escaping class

On 9/18/12 1:55 PM, Stas Malyshev wrote:

Again, nowhere it is said that you can not apply different filters to different data or different context. Again, you narrow down definition of filtering, to which I see no purpose unless you seek to arrive at pre-determined conclusion that we need to duplicate APIs because it's called "filter".

I agree that filtering can mean general processing of data, but if we embrace this definition in the filter extension, why not deprecate *all* string functions and replace them with FILTER_SANITIZE_* constants? I'd argue because naming matters, and *option* constants should not be used to wildly change behavior. Filter has already gone down this road--I doubt the value added by having a second, much more verbose way to call htmlspecialchars()--but I don't see why we must continue down that path. Steve -- http://www.mrclay.org/