Re: [PHP-I18N] Resources for multi-byte character security?

On Thu, 2024-08-01 at 13:56 -0700, Tex wrote:
> Nick see
> https://www.unicode.org/reports/tr36/
> Unicode Security Considerations
>=20
> and
>=20
> =C2=A0https://unicode.org/reports/tr39/
> Unicode Security Mechanisms
> Tex

Thank you.

I read through the Unicode Security Considerations (tr36) last night
and will read the second one later.

I made a list of questions as I read:

1. If we want to use UTF-8 as the encoding through the entire
application flow, which settings need to be set, and where?

There are several encoding settings in PHP, mb* encoding settings,
several places in HTML where you can put a charset (meta head, server
headers, forms), and the default for HTML5 is supposed to be UTF-8
anyway.

Some of these settings seem redundant.

2. Assuming the HTML is setup correctly, is the browser responsible for
input encoding? ie. if a user submits a textarea element as part of an
HTML form that has `Windows-1252` pasted in from MS Word with curly
quotes, is it the browser's job to convert the Windows-1252 to UTF-8 on
paste and only send UTF-8 to the server, so, theoretically, we
shouldn't have to deal with anything other than UTF-8 in our
application if we set the options correctly in the HTML?