Re: [VOTE] Improve HTML escape

Hi Angel, On Fri, Feb 21, 2014 at 5:43 AM, Ángel González <keisial@gmail.com> wrote: > I see the point to change the default value, but I don't think PHP should > ignore the flags requesting a specific behavior. It's better to escape all chars always. IMHO. It's safer. Code will be a little simpler, too. However, it is understandable. We have - ENT_NOQUOTES (skip escaping quotes - this is NOT deprecated) - ENT_COMPAT (escape only " - deprecation is proposed) - ENT_QUOTES (escape " and ' - deprecation is proposed) Deprecation can be dropped and it's possible to honor all of these. I proposed deprecation since I could not think of use case other than test program compatibility. Are there use cases? I don't mind adding - ENT_SINGLE(escape only ') - ENT_DOUBLE(escape only ". Same as ENT_COMPAT, but better name) as HTML5 supports ", ' and no quotes for attributes. It seems good for completeness. This would be issue for new RFC, though. I may write new RFC for this when this is over if many of think this is better to have. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net