Re: [RFC] Improve HTML escape

Hi Stas, On Tue, Feb 4, 2014 at 7:21 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote: > > Use of this option is not recommended, but there is the standard. We may > > support it even if we don't recommend it. > > Nowhere in any standard it says we must use htmlentities to support > every possible context. There are contexts where htmlentities is > completely unsuitable - such as unquoted attributes, Javascript, CSS, > etc. In these contexts, other ways of escaping output should be used. > > I get an impression you're trying to fit a square peg into a round hole > here. There are other ways to escape things and they should match the > context the output is used in. Trying to serve every scenario with one > function would not work. We may or may not support unquoted attributes. I think it's really dangerous, therefore we my not support it ;) It may be good for PHP to declare "We support HTML5!", though. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net