Hi Stas,
On Tue, Feb 4, 2014 at 7:21 AM, Stas Malyshev <[email protected]>wrote:
> > Use of this option is not recommended, but there is the standard. We may
> > support it even if we don't recommend it.
>
> Nowhere in any standard it says we must use htmlentities to support
> every possible context. There are contexts where htmlentities is
> completely unsuitable - such as unquoted attributes, Javascript, CSS,
> etc. In these contexts, other ways of escaping output should be used.
>
> I get an impression you're trying to fit a square peg into a round hole
> here. There are other ways to escape things and they should match the
> context the output is used in. Trying to serve every scenario with one
> function would not work.
We may or may not support unquoted attributes.
I think it's really dangerous, therefore we my not support it ;)
It may be good for PHP to declare "We support HTML5!", though.
Regards,
--
Yasuo Ohgaki
[email protected]