Re: XML_Feed_Parser and HTML security

What you're proposing is best handled in documentation. The installation messages are already cluttered enough, no one will read them at all if we keep adding stuff. Greg David Coallier wrote: > Actually have a sample Safe class in the docs would be the same thing as > telling the user to use HTML_Safe, most wouldn't and would complain anyhow. > > I do not agree on putting a small class aside that would extend, > although what we could do is a flag in the package.xml that states that > this package's output should be escaped: > <installMSG>Output Should be escaped using HTML_Safe</installMSG> > > Then when installing: > root@serependity:/home/david# pear install PEAR_Package-alpha > downloading PEAR_Package-0.0.1.tgz ... > Starting to download PEAR_Package-0.0.1.tgz (8,358 bytes) > .....done: 8,358 bytes > Info: Output should be escaped using HTML_Safe > install ok: channel://pear.php.net/PEAR_Package-0.0.1 > > > But yes, that would involve adding some stuff to the pear installer, and > more xml parsing, maybe it's a little too overhead but for long term I > believe that this could be a cool way of doing stuff. Even a tag > <safeHTML/> that would output the message automatically. > > So the Info message and the docs should give the users an idea that this > is important .. I guess they would understand but again.. i am not > everyone :-)