Hi Stas,
On Sun, Feb 2, 2014 at 7:21 PM, Stas Malyshev <[email protected]>wrote:
> > Making ENT_QUOTES as a default is good idea also.
> > I should have add this to the RFC.
>
> Why is it a good idea? Could you explain what it adds to the security of
> this function?
Users can do
<tag attr='<?php echo htmlentities($str)?>' >
and this is valid. I think there is no reason not to escape ' by default.
I agree that user should not use unquoted attributes in general.
'/' escape could be still useful. For example, user may have validation
code that allows printable ASCII chars w/o spaces. '/' escape may protect
apps from generating invalid tag in this case.
We could say "your application is broken in first place".
However, both "'" and '/" escapes do not break apps at all, yet it
covers some issues.
There is no reason not to escape these chars by default. IMHO.
Regards,
--
Yasuo Ohgaki
[email protected]