On 02.02.2014, at 11:21, Stas Malyshev <[email protected]> wrote:
>> Making ENT_QUOTES as a default is good idea also.
>> I should have add this to the RFC.
>
> Why is it a good idea? Could you explain what it adds to the security of
> this function?
I suppose the argument could be made for "safe by default", since single quotes are now
valid for HTML attributes as well. (I miss XHTML...)
More interesting to me, what's the use case for ENT_NOQUOTES? This one causes issues whatever
attribute syntax one chooses.
Best regards
Rouven