4 ms·
"Large PHP applications" doesn't immediately express to me that you combine styles, scripts, and markup in your templates and have a need for automated context-
by omgitsabird 5y ago
"Large PHP applications" doesn't immediately express to me that you combine styles, scripts, and markup in your templates and have a need for automated context-aware escaping.
- lucideer 5y agoIt doesn't need to. "Large PHP application" just means "at scale", in terms of LoC, and - most likely - contributors. Which means (a) potentially anything may be combined in templates by somebody at some point without careful manual code-review, which is difficult to audit at scale, and (b) there are a larger number of files to audit, likely with a degree of complexity to their overall structure, which further adds to that difficulty.
- omgitsabird 5y agoYou can overcome this using a linter that doesn't allow expressions in those contexts, no?