push eventiFixit/php-src

Daniel Beardsley

commit sha 53c14143413a7564790eb0c47e0fa7c383b8cde9

PHP Templates: add optional autescaping to echo/<?= Background ========== PHP doesn't have any mechanism to inject logic between templating and final output. There is no way to filter or alter the content that comes from code in templates like: <?= $someVar ?> To use php as a robust templataing language, we must inject *some* logic between templates and their output. We have chosen to make all <?=, echo, and print statements subject to an optional trip through escape_html_entitiles. The functionality can be toggled with `ini_set('__auto_escape')` and configured with `__auto_escape_flags` and `__auto_escape_exempt_class` (see commit 2dae5d16436ce37856f6e00ca2a1b3009bb1f7ed for info about the class name based auto-escaping exemption. Methodology =========== T_ECHO (echo, <?=), T_PRINT (print) now both emit a ZEND_AST_ECHO_ESCAPE node in the syntax tree. That's compiled to a function which emits a ZEND_ECHO_ESCAPE op code. The op code interpretation is a dupe of ZEND_ECHO except with some if() statements that switch the underlying function from `zend_write` to `zend_write_escape` based on the ini settings. zend_write_escape is a new function pointer that points to php_escape_write. php_escape_write is a new function that passes it's string argument through php_escape_html_entities() (with __auto_escape_flags) before calling the underlying php_output_write. Use === This functionality allows us to safely use php straight as a templating language with no template compilation step (as many other templating libraries have). See the included tests for more usage information. Exempt Class ============ It is useful to allow some utility functions and helpers to produce html and have it passed straight through in the template (without being double-encoded). We accomplish this by *tagging* strings as being HTML. class HtmlString implements JsonSerializable { protected $html = ''; public function __construct($html) { $this->html = $html; } public function __toString() { return (string)$this->html; } public function jsonSerialize() { return $this->html; } } The auto-escaping system can be configured with an: __auto_escape_exempt_class="HtmlString" Which allows instances of `HtmlString` to pass straight through a template without being modified (skipping the html_entities call). Helper functions can now return html safely and consumers don't have to care if it is HTML or not because the auto-escaping system knows what to do. squash with big commit

view details

David Rans

commit sha 8b9f461f0a2a27423d763b6982154d60c68d6e3c

SCCP: optimize ZEND_ECHO_ESCAPE the same as ZEND_ECHO The compiler tries to figure out at compile time which `echo` statements are, for example, going to be noops. The same rules should apply to ECHO_ESCAPE as well.

view details

David Rans

commit sha 89c83bde36e13cdb2b40247c8fc924a8a88f2966

Auto-generated files: update The previous commit updated zend_vm_def and others that are used as inputs to these auto-generated files. Run php Zend/zend_vm_gen.php and commit the result.

view details

Daniel Beardsley

commit sha ae6a5d2de3aaabaacca3e226a6562bb08205b9e7

README: update for our build

view details

push time in 3 days