Re: [RFC] Improve HTML escape

Hi! > Some users has to confirm standard like PCI DSS. > PCI DSS requires to follow security standards and guidelines from OWASP, > SANS, etc. > > Why not make PHP standard compliant? > It does not hart existing applications at all and this is simple enough > change. I'm sorry, could you please quote me a standard that requires PHP to escape / in function called htmlentites? If there's no such standard, the argument of "but the standard requires it" is void. No standard can require you to use htmlentites where it should not be used. Putting stuff into language just because somebody in the internet mentioned in different context that it might be a good idea - is not. We should understand _why_ it is done and _why_ it is a good idea, especially when we're talking about security. In this case, the proposed use case should _never_ be used with htmlentities, due to obvious gaping security hole. Adding code to enable such scenario is just not right. Instead, we should tell people "Never ever do it. Ever.". -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227