Re: RFC: Implementing a core anti-XSS escaping class
| From: | Andrew Faulds | Date: | Tue, 18 Sep 2012 20:12:06 +0000 |
| Subject: | Re: RFC: Implementing a core anti-XSS escaping class | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-63115@lists.php.net to get a copy of this message | ||
On 18/09/12 21:11, Paul Dragoonis wrote:
The existing implementations at symfony\zend are working pretty well. They're using string manipulation and regex functions. If we port it to C, can't we still use the exact same functions that the PHP_FUNCTION() macros are calling to pretty much clone it. Would this minimise the amount of change (if any) ? To some extent, yes, but Rasmus is right in that there would be certain bugs. In C, we don't have implicit string casting, for example.-- Andrew Faulds http://ajf.me/