Re: [RFC] Improve HTML escape
| From: | Rouven Weßling | Date: | Sun, 02 Feb 2014 11:08:22 +0000 |
| Subject: | Re: [RFC] Improve HTML escape | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-71991@lists.php.net to get a copy of this message | ||
On 02.02.2014, at 11:21, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
>> Making ENT_QUOTES as a default is good idea also.
>> I should have add this to the RFC.
>
> Why is it a good idea? Could you explain what it adds to the security of
> this function?
I suppose the argument could be made for "safe by default", since single quotes are now
valid for HTML attributes as well. (I miss XHTML...)
More interesting to me, what's the use case for ENT_NOQUOTES? This one causes issues whatever
attribute syntax one chooses.
Best regards
Rouven