Re: [RFC] Improve HTML escape

From: Date: Sun, 02 Feb 2014 13:55:32 +0000
Subject: Re: [RFC] Improve HTML escape
References: 1 2 3 4 5  Groups: php.internals 
Request: Send a blank email to internals+get-71997@lists.php.net to get a copy of this message
Hi all, It's dated but: https://wiki.php.net/rfc/escaper I see Yasuo edited it a wee bit in September on its 1 year anniversary to add ext/filter as an option. I had hoped Anthony would get around to it but c'est la vie. Without quotes you need to escape almost ALL non alphanumeric characters in an attribute value just to make sure you cover every known and unknown browser parsing oddity. It's just a bad practice full stop despite HTML5 allowing it. ENT_QUOTES should be the default for obvious reasons. It escapes quotes. htmlentities() doesn't anything more than htmlspecialchars() unless you count turning "Pádraic Ó'Brádaigh" into "Pádraic Ó'Brádaigh" as a positive benefit to the Irish language and the size of its webpages :P. Paddy -- Pádraic Brady http://blog.astrumfutura.com http://www.survivethedeepend.com Zend Framework Community Review Team Zend Framework PHP-FIG Representative

« previous php.internals (#71997) next »