Re: [RFC] Improve HTML escape

Hi all, On Mon, Feb 3, 2014 at 10:43 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > On Sun, Feb 2, 2014 at 7:21 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote: > >> > Making ENT_QUOTES as a default is good idea also. >> > I should have add this to the RFC. >> >> Why is it a good idea? Could you explain what it adds to the security of >> this function? > > > Users can do > > <tag attr='<?php echo htmlentities($str)?>' > > > and this is valid. I think there is no reason not to escape ' by default. > > I agree that user should not use unquoted attributes in general. > > '/' escape could be still useful. For example, user may have validation > code that allows printable ASCII chars w/o spaces. '/' escape may protect > apps from generating invalid tag in this case. > > We could say "your application is broken in first place". > However, both "'" and '/" escapes do not break apps at all, yet it > covers some issues. > > There is no reason not to escape these chars by default. IMHO. > Even we may deprecate ENT_COMPAT and ENT_QUOTES. We may ignore them and escape all chars recommended by OWASP always. (Except ENT_NOQUOTES) I think ENT_COMPAT/ENT_QUOTES does bad things rather than good. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net