Re: [RFC] Improve HTML escape

Hi Stas, On Sun, Feb 2, 2014 at 7:21 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote: > > Making ENT_QUOTES as a default is good idea also. > > I should have add this to the RFC. > > Why is it a good idea? Could you explain what it adds to the security of > this function? Users can do <tag attr='<?php echo htmlentities($str)?>' > and this is valid. I think there is no reason not to escape ' by default. I agree that user should not use unquoted attributes in general. '/' escape could be still useful. For example, user may have validation code that allows printable ASCII chars w/o spaces. '/' escape may protect apps from generating invalid tag in this case. We could say "your application is broken in first place". However, both "'" and '/" escapes do not break apps at all, yet it covers some issues. There is no reason not to escape these chars by default. IMHO. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net