Re: [RFC] Improve HTML escape
| From: | Rouven Weßling | Date: | Sun, 02 Feb 2014 22:55:21 +0000 |
| Subject: | Re: [RFC] Improve HTML escape | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72020@lists.php.net to get a copy of this message | ||
On 02.02.2014, at 14:55, Pádraic Brady <padraic.brady@gmail.com> wrote:
> Without quotes you need to escape almost ALL non alphanumeric characters in an attribute value
> just to make sure you cover every known and unknown browser parsing oddity. It's just a bad
> practice full stop despite HTML5 allowing it.
>
> ENT_QUOTES should be the default for obvious reasons. It escapes quotes.
Just to be clear, the current default (ENT_COMPAT) does escape double quotes. The change to
ENT_QUOTES would escape single quotes as well.
Best regards
Rouven