> > echo $sf_data->get('variable', ESC_METHOD);
>
> Thats a lot of characters for outputting a single variable. Thats what I
> mean with hassle.
If you set your escaping strategy to 'both' then you could output
anything that will be fine escaped for HTML by just doing echo
$variable.
$sf_data->get('variable',ESC_JS) is shorter than
htmlspecialchars($variable,ENT_QUOTES, 'UTF-8'), but I do see your
point...
> > The idea behind the escaping strategy is that you should escape by
> > default. This avoids human error as much as possible. In the majority
> > of cases people actually want their variables escaped (although they
> > may not realise it)
>
> Yes and no .. it also means that the developer will get a habit of not
> thinking about it ..
I'm not convinced. If you forget to escape a variable, then you never
notice until somebody cross site scripts your site. However if you
forget to /un/escape a variable you'll probably get & on your
screen... Secure by default.
Paul
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"symfony developers" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/symfony-devs?hl=en
-~----------~----~----~----~------~----~------~--~---
