Re: RFC: Implementing a core anti-XSS escaping class

Hi Michael, > After looking over the RFC finally, would it be that crazy to consider > this an extension of the standard string functions? > > str_escape($string, $encoding, $flags) or probably better > str_escape($string, $flags, $encoding) - since encoding could be > defaulted to UTF-8, but flags are really what differentiate the > behavior... > > Then there is not a handful of functions but rather one that can be > used as the abstraction point and the flags passed to it will change > it's behavior, much like the filter functions. > > (I just see this falling under one solid defacto escape function > standard, and it could live by itself as "escape" or something, or as > it operates on strings, prefix it as such) I think the filter_var() approach to using flags to switch core behaviour is flawed for any number of reasons but consider being a programmer writing PHP templates... htmlspecialchars($value, ENT_QUOTES|ENT_SUBSTITUTE, 'utf-8'); str_escape($string, ESCAPE_HTML_BODY, 'utf-8'); vs escape_html($value, 'utf-8'); $e->escapeHtml($value); Brevity and a clear meaning have their advantages. Paddy -- Pádraic Brady http://blog.astrumfutura.com http://www.survivethedeepend.com Zend Framework Community Review Team