Re: [RFC] Improve HTML escape
Hi all,
It's dated but: https://wiki.php.net/rfc/escaper
I see Yasuo edited it a
wee bit in September on its 1 year anniversary to add ext/filter as an
option. I had hoped Anthony would get around to it but c'est la vie.
Without quotes you need to escape almost ALL non alphanumeric characters in
an attribute value just to make sure you cover every known and unknown
browser parsing oddity. It's just a bad practice full stop despite HTML5
allowing it.
ENT_QUOTES should be the default for obvious reasons. It escapes quotes.
htmlentities() doesn't anything more than htmlspecialchars() unless you
count turning "Pádraic Ó'Brádaigh" into "Pádraic
Ó'Brádaigh" as a positive benefit to the Irish language and
the size of its webpages :P.
Paddy
--
Pádraic Brady
http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative
Thread (37 messages)