Like many others, I prefer to use procedural PHP as a template language. While PHP’s syntax makes it a practical choice for this, there is a problem with embedding dynamic content. Most PHP applications produce HTML output, so you end up writing <?php echo htmlspecialchars($foo);?> a lot, using this technique. Or you forget it, and make your application prone to all sorts of nasty XSS attacks.
Apart from the annoyance of superfluous typing, there is a danger of getting lazy, seeing that <?php echo $foo;?> is remarkably shorter to type. In some situations, it won’t manifest itself as a problem either, since some content-types never contains HTML special characters (Numbers for example). This is particularly nasty, because errors in the view layer are notoriously hard to track down, and unlike SQL-injections — a similar problem — the consequences tend to hurt the users of a site, rather than the site directly.
KISS
Recently, I had a look at some code, written for CakePHP. My eye caught a function e, which is shorthand for echo. A single letter, regular function is undoubtedly the simplest way to extend PHP’s syntax. Thinking about it, it’s fairly obvious, but it just never occurred to me.
Well, the CakePHP developers made a mistake, as it should have been shorthand for echo htmlspecialchars. Nonetheless, the syntax works well. So I began using a globally defined function which looks a bit like this:
function e($string) {
echo htmlspecialchars($string);
}
And it works too. It saves me typing and keeps me from forgetting to escape output, because I have to do more work to output strings unescaped, than not. Simple, but powerful.
The clash
There is a problem though; Since this is such a good name for a function, chances are that someone else would use it for something different, or perhaps even for the same. I already know of at least one potential nameclash, since I got the idea from CakePHP.
The usual way of dealing with this, would be with namespaces, but — alas — PHP doesn’t have namespaces (yet), and the common solution of pseudo namespaces (Eg. prefixing names) doesn’t work here, since it would defy the purpose of the function in the first place.
There’s another problem too. In the few cases, where we aren’t rendering HTML/XML output, we don’t want to escape strings for embedding in HTML/XML — instead, we want to escape it for embedding in that target language. Even in HTML, it may be necessary to escape strings with htmlentities, rather than htmlspecialchars, if the text encoding isn’t ISO-8859-1. Or encode the string to UTF-8, if the template is in UTF-8.
Making the static dynamic
The problem with all this is, that the function is static — That’s the nature of global functions in PHP. Other interpreted languages allows us to redefine functions at runtime, but no such luck with PHP (Well, strictly speaking, runkit allows it, but no-one in their right mind would use it in a production environment).
There is however a loophole; Using a callback, we can delegate to a dynamically defined handler:
if (!function_exists('e')) {
function e($args) {
$args = func_get_args();
return call_user_func_array($GLOBALS['_global_function_handler_e'], $args);
}
}
Much better — Now I can define my own output handler as:
$GLOBALS['_global_function_handler_e'] = 'my_global_function_handler_e';
function my_global_function_handler_e($string) {
echo htmlspecialchars($string);
}
And CakePHP can use:
$GLOBALS['_global_function_handler_e'] = 'cakephp_global_function_handler_e';
function cakephp_global_function_handler_e($string) {
echo htmlspecialchars($string);
}
We’re still using a global symbol, but at least it’s dynamic, rather than static.
So here’s a plea to framework writers in the PHP world: If we could all agree to do this for any function, defined in the global scope, which has an obvious risk of nameclashing, I think we would all be better off.
Just a humble suggestion of course.
This article provided by sitepoint.com.
We already knew that 
SanDisk has decided to be a little bit more adventurous with their Cruzer line of USB flash drives, launching the Colors+ range that will feature ten different shades for you to choose from. I know that USB flash drives aren’t exactly Pokemon so you probably won’t have this innate need to catch ‘em all, but it is always nice to have options when purchasing a product. Gone are the days where the Ford Model T came in only one color - dreary black at that. Which would be your color of choice?
While Microsoft has already stopped supporting Windows 98 for quite some time already, you’ll be surprised to know that Nintendo has just pulled the plug where support for the NES, SNES, N64, Gameboy, and the Gameboy Pocket after all these decades. It is pretty interesting to note that up through last week, it is still possible to send your creaking NES system to Nintendo for a full factory repair. Talk about an amazing level of service that other companies would do well to emulate, where support for legacy devices are crucial to maintaining customer loyalty. Drats, looks like I have to take better care of my monochrome LCD Gameboy from now onwards.
Entries (RSS)