Hi all,
On Mon, Feb 3, 2014 at 10:43 AM, Yasuo Ohgaki <[email protected]> wrote:
> On Sun, Feb 2, 2014 at 7:21 PM, Stas Malyshev <[email protected]>wrote:
>
>> > Making ENT_QUOTES as a default is good idea also.
>> > I should have add this to the RFC.
>>
>> Why is it a good idea? Could you explain what it adds to the security of
>> this function?
>
>
> Users can do
>
> <tag attr='<?php echo htmlentities($str)?>' >
>
> and this is valid. I think there is no reason not to escape ' by default.
>
> I agree that user should not use unquoted attributes in general.
>
> '/' escape could be still useful. For example, user may have validation
> code that allows printable ASCII chars w/o spaces. '/' escape may protect
> apps from generating invalid tag in this case.
>
> We could say "your application is broken in first place".
> However, both "'" and '/" escapes do not break apps at all, yet it
> covers some issues.
>
> There is no reason not to escape these chars by default. IMHO.
>
Even we may deprecate ENT_COMPAT and ENT_QUOTES. We may ignore
them and escape all chars recommended by OWASP always. (Except ENT_NOQUOTES)
I think ENT_COMPAT/ENT_QUOTES does bad things rather than good.
Regards,
--
Yasuo Ohgaki
[email protected]