I do think both sides are making some good points, and we both have the common goal: make unfiltered data hard to get, and filtered data easy.
In the proposed implementation (with Input::*), we should *definitely* clear the superglobals, so people are forced to go through more hoops to get unfiltered data. Could we potentially sink a plugin hook within Input::*($index, false), such that a plugin could be activated which would provide logging information of all instances. I am not set on the false syntax – I think it should be even harder to get the raw values. Maybe having to go through the straight array instead. However, I *do* think Input::post($index) is easier than our current implementation, which makes it an improvement since we want to make the filtered data really easy to get. I think the idea is to make the syntax work like everything else in Habari, precisely since these new variables do *not* behave the same way as in the rest of PHP. Having a clear difference in syntax shows that and also gets people used to the Habari filtering mechanism. On Dec 3, 2008, at 10:47 AM, Sean Coates wrote: > True, those might be the Habari way, but what we intend here is not to > make these variables work like everything else (everything else in > Habari? or everything else in PHP? different things...). The syntax > doesn't do exactly what we need (unless we unset the super globals). > What we need is for people to not accidentally use unescaped data in > the wrong context. --~--~---------~--~----~------------~-------~--~----~ To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/habari-dev -~----------~----~----~----~------~----~------~--~---
