Dirk: htmlspecialchars vs. htmlentities

2010-01-30T20:15:59Z

htmlspecialchars vs. htmlentities

Dirk: started a Best Practices list

2010-01-30T19:51:59Z

started a Best Practices list

New page

== Use E_ALL ==

During development, set the error reporting to <code>E_ALL</code>, i.e. the highest warning level. This helps expose common errors like uninitialized variables.

Tip: In <tt>lib-common.php</tt>, add an extra <code>error_reporting(E_ALL)</code> statement like so:

<pre>
// Prevent PHP from reporting uninitialized variables
error_reporting(E_ERROR | E_WARNING | E_PARSE | E_COMPILE_ERROR | E_USER_ERROR);
error_reporting(E_ALL);
/**
* This is the common library for Geeklog. Through our code, you will see
</pre>

Adding the <code>error_reporting</code> in this otherwise empty line means that you only get an additional one-line difference when doing a <tt>hg diff</tt> (or similar). It's also easier to remove than when you edit the existing <code>error_reporting</code> line.

== Don't use the ereg family of functions ==

The ereg pattern matching functions (<code>ereg_replace</code>, etc.) will be removed in PHP 6. They are already throwing "deprecated" warnings in PHP 5.3.

Use <code>str_replace</code> (preferred) or <code>preg_replace</code> and similar functions instead.

Also see: [http://project.geeklog.net/tracking/view.php?id=967 Bug #0000967: Get rid of the ereg functions]

[[Category:Development]]

← Older revision		Revision as of 20:15, 30 January 2010
Line 23:		Line 23:

	Also see: [http://project.geeklog.net/tracking/view.php?id=967 Bug #0000967: Get rid of the ereg functions]		Also see: [http://project.geeklog.net/tracking/view.php?id=967 Bug #0000967: Get rid of the ereg functions]
		+
		+
		+	== Use htmlspecialchars instead of htmlentities ==
		+
		+	When preparing content for display, you may want to ensure that certain special characters are displayed as-is instead of being interpreted (e.g. pointy brackets which may be mistaken for HTML tags). PHP provides several functions to do that. Usually, the function to use it <code>htmlspecialchars()</code>. Do not use <code>htmlentities()</code> for content, as this may inadvertently break special characters in some languages (e.g. Japanese).


	[[Category:Development]]		[[Category:Development]]

Best Practices - Revision history

Dirk: htmlspecialchars vs. htmlentities

Dirk: started a Best Practices list