5 ms·
What's wrong with nl2br? Seems to do what it says on the tin.
by jiggy2011 14y ago
What's wrong with nl2br?
Seems to do what it says on the tin.
- true_religion 14y agoWhy do trivial functions have to be added to the language core?
- jiggy2011 14y agoWhy not? Most languages have a standard library that does all kinds of simple but useful stuff. PHP is aimed at the web so a function that deals with part of the web/non-web mismatch seems like a useful thing to include. Removing it would simply cause newbies to have to wrange with str_replace to build trivial web apps.
- madjar 14y agoExcept the problem most people actually want to solve is not "convert newlines to <br>", it is "convert some text to html", and this function may lead to think that it does that, when it only does a tiny fraction of that. And that's how injections are born.
- jiggy2011 14y agoIf you're dealing with ascii plaintext the main significant difference is how it deals with new lines vs HTML. The function never purports to do anything other than convert newlines to BR tags.
- tolmasky 14y agoWhat is being suggested is that the plaintext may contain a random html tag (Perhaps if supplied by a user, or perhaps because that tag is meant to be displayed as plaintext as well. The reason doesn't rally matter, "tags" in any situation are still valid plaintext). By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML -- however now that tag from before can take effect (particularly bad if its a script tag). Thus, this function doesn't make sense unless it is at least also coupled with HTML escaping.
- timdev2 14y ago> By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML I don't see how that's implied at all. After all, the function is named nl2br, not html2text.
- tolmasky 14y agoIt's implied because basically the only context under which <br>'s are used is when appearing in HTML. If someone is taking text, converting the newlines to <br>'s, then there's a 99.9% chance that the next step is that that text is going to be placed in a larger HTML document. Unless of course I'm forgetting some alternative use of <br>'s. I agree the function does exactly what it says it will do. And if this was a private function used by something like text2html internally, then maybe it might be a fine function. However, as a public function, the argument is that it inspires bad programming practices, since again, it is almost certainly being used as a primitive form of "sanitation" or "conversion" before displaying plaintext in a larger HTML document. I think if you could come up with an example of how this would be used NOT as an immediate precursor to dropping into HTML I could be convinced otherwise (and saying it is used after the other tags go through a sanitation process is a poor response, since it means this function must always follow the other one -- further proving its uselessness as a standalone function).
- tarabukka 14y agoI have never, ever seen nl2br referred to as making anything secure or safe. It just converts new lines to <br />s. That's what the manual says it does. That's what tutorials say it does. That's what the function name very obviously shows. I think map() from Python should be removed. Its name implies to a new learner that it will draw a map, but it actually does nothing to that effect at all! No, it maps an array to a function. We must rename this dangerous function to call_a_function_on_every_element_of_an_array - or, even better, remove it from the language core ENTIRELY. If it was a private function used inside the runtime, maybe that would be fine, but it's a public part of the API.
- skoob 14y agoWhich is fine, as long as you make sure that your text doesn't contain any characters like "&", "<" or ">".
- Firehed 14y agoI've never once had the impression that nl2br did anything more than make whitespace significant in an HTML document. Even during my first days of using PHP... I don't think there's anything in the documentation or even trivially basic experimentation that could reasonably lead someone to believe that. Plus the actual HTML-escaping tools (htmlspecialchars, htmlentities) do not make whitespace significant. Though these days, you might arguably be better off with "white-space: pre-line" in CSS instead.
- pornel 14y agoIt does less than making HTML whitespace-significant. It's unsuitable for use on HTML markup, because newlines in <script>, inside tags, attributes, comments, etc. should not be changed. It's only safe and reliable as a part of nl2br(htmlspecialchars()) combo, so a function that does both could have been a better idea.
- lucian303 14y agoIt's named quite well and explains exactly what it does. If you think this converts text to html you haven't read the manual. RTFM before programming or get out of the fucking field.
- ksherlock 14y agoHere's my problem with nl2br: Prior to 4.0.5, it used "<br>". As of 4.0.5, they switched to "<br />". (As of 5.3.0, they did the obvious thing and added a second parameter, is_xhtml). This isn't an isolated incident -- any minor update is liable to change how a function works or what parameters it can take. So you're better off writing it yourself (or doing it inline with a string replace or regular expression).
- josegonzalez 14y ago4.0.5 was released in 2001, more than a decade ago. When complaining about a language, complain about a current, feature breakage, not an old one that has since been fixed (5.3.0 came out in 2009, 3 years ago).
- smsm42 14y agoSo, where's a problem? That is some godforsaken version that is dead for many years and nobody uses it it was working differently? It's not a problem, it's a feature - the language evolves and changes according to what people need. It happens with all languages and all libraries and all code.