Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Michael Shadle
On Sep 19, 2012, at 10:55 AM, Pádraic Brady wrote: > I have never once expressed a problem with this being a set of > procedural function. Not once. The RFC offers some suggested function > signatures. So nobody has expressed any issues and nobody has insisted > that you be required to use a cla

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Pádraic Brady
Hi Michael, >> It feels like this is just using classes for the sake of using >> classes, adding an unnecessary layer of complexity (and discussion) >> for no real reason except that is the RFC authors preference. > > +1 > > First the discussion was filtering vs escaping. Now it is about how to >

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Michael Shadle
On Wed, Sep 19, 2012 at 9:08 AM, Andrew Faulds wrote: > Yes, but typing the encoding every time is cumbersome. Or, if you don't want > to set it every time, you'd have to set it globally. Then, you forgot to > change it back somewhere when you're dealing with multiple encodings, and it > all goes

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Leigh
> Call it str_escape(string, flags optional, encoding optional) and be done > with it. Keeping it simple definitely preferred > 1) do we even need encoding or is UTF8 just fine Definitely need encoding. mbstring supports quite a lot http://php.net/manual/en/mbstring.supported-encodings.php I

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Michael Stowe
Personally, I would like to see it operate similar to MySQLi, where you have the convenience of OOP, but can still call a function directly in a procedural manner. And I definitely feel like we need encoding. We can default it to UTF-8 or to the zend.script_encoding if set, but I think it needs t

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Andrew Faulds
On 19/09/12 17:06, Michael Shadle wrote: It feels like this is just using classes for the sake of using classes, adding an unnecessary layer of complexity (and discussion) for no real reason except that is the RFC authors preference. +1 First the discussion was filtering vs escaping. Now it is

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Michael Shadle
> It feels like this is just using classes for the sake of using > classes, adding an unnecessary layer of complexity (and discussion) > for no real reason except that is the RFC authors preference. +1 First the discussion was filtering vs escaping. Now it is about how to implement it as a clas

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Pádraic Brady
Hi Leigh, On Wed, Sep 19, 2012 at 3:10 PM, Leigh wrote: >>> I missed the encoding parameter. While it's still possible to add that >>> to a static-only class, that would be more cumbersome and less correct >>> than instantiation (since the encoding is state, technically). My >>> apologies. Carry

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Leigh
>> I missed the encoding parameter. While it's still possible to add that >> to a static-only class, that would be more cumbersome and less correct >> than instantiation (since the encoding is state, technically). My >> apologies. Carry on ;-) It's probably already been covered, but I don't like t

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Pádraic Brady
No need to apologise ;). Just wanted to clarify that the character encoding drives the choice of class since it can be easy to miss its importance - amended the RFC a little to highlight it. Paddy On Wed, Sep 19, 2012 at 12:55 PM, Tomas Creemers wrote: > On Wed, Sep 19, 2012 at 9:58 AM, Pádraic

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Tomas Creemers
On Wed, Sep 19, 2012 at 9:58 AM, Pádraic Brady wrote: > You did notice the character encoding parameter to the constructor? The point > of the class is to share that little piece of state and omit it as a required > method parameter thus removing one OOP layer for those practicing OOP like > al

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Sebastian Krebs
2012/9/19 Tomas Creemers > On Wed, Sep 19, 2012 at 8:34 AM, Sebastian Krebs > wrote: > > > > > > 2012/9/19 Tomas Creemers > >> > >> Hi all, > >> > >> > >> > >> If this is going to be implemented as a class, what is the advantage > >> of instantiation for this? Unless I'm missing it, I would pro

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Sebastian Krebs
2012/9/19 Tomas Creemers > On Wed, Sep 19, 2012 at 8:34 AM, Sebastian Krebs > wrote: > > > > > > 2012/9/19 Tomas Creemers > >> > >> Hi all, > >> > >> > >> > >> If this is going to be implemented as a class, what is the advantage > >> of instantiation for this? Unless I'm missing it, I would pro

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Pádraic Brady
You did notice the character encoding parameter to the constructor? The point of the class is to share that little piece of state and omit it as a required method parameter thus removing one OOP layer for those practicing OOP like all the major frameworks. The RFC notes already that character

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-19 Thread Tomas Creemers
On Wed, Sep 19, 2012 at 8:34 AM, Sebastian Krebs wrote: > > > 2012/9/19 Tomas Creemers >> >> Hi all, >> >> >> >> If this is going to be implemented as a class, what is the advantage >> of instantiation for this? Unless I'm missing it, I would propose that >> the functions are made static. >> [sni

Re: [PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-18 Thread Sebastian Krebs
2012/9/19 Tomas Creemers > Hi all, > > > > If this is going to be implemented as a class, what is the advantage > of instantiation for this? Unless I'm missing it, I would propose that > the functions are made static. > > In other words, I would prefer this: > > echo Escaper::escapeHtml('test');

[PHP-DEV] Re: RFC: Implementing a core anti-XSS escaping class

2012-09-18 Thread Tomas Creemers
Hi all, If this is going to be implemented as a class, what is the advantage of instantiation for this? Unless I'm missing it, I would propose that the functions are made static. In other words, I would prefer this: echo Escaper::escapeHtml('test'); over this: $e = new Escaper; echo $e->esc