Re: [VOTE] Improve HTML escape
Hi Angel,
On Fri, Feb 21, 2014 at 5:43 AM, Ángel González <[email protected]> wrote:
> I see the point to change the default value, but I don't think PHP should
> ignore the flags requesting a specific behavior.
It's better to escape all chars always. IMHO. It's safer. Code will be a
little simpler, too.
However, it is understandable. We have
- ENT_NOQUOTES (skip escaping quotes - this is NOT deprecated)
- ENT_COMPAT (escape only " - deprecation is proposed)
- ENT_QUOTES (escape " and ' - deprecation is proposed)
Deprecation can be dropped and it's possible to honor all of these. I
proposed deprecation since I could not think of use case other than test
program compatibility. Are there use cases?
I don't mind adding
- ENT_SINGLE(escape only ')
- ENT_DOUBLE(escape only ". Same as ENT_COMPAT, but better name)
as HTML5 supports ", ' and no quotes for attributes. It seems good for
completeness. This would be issue for new RFC, though. I may write new RFC
for this when this is over if many of think this is better to have.
Regards,
--
Yasuo Ohgaki
[email protected]
Thread (9 messages)