#40017 [Opn->Bgs]: htmlentities double escaping
| From: | tony2001@php.net | Date: | Thu, 04 Jan 2007 10:20:48 +0000 |
| Subject: | #40017 [Opn->Bgs]: htmlentities double escaping | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-107162@lists.php.net to get a copy of this message | ||
ID: 40017
Updated by: tony2001@php.net
Reported By: thedewi at hotmail dot com
-Status: Open
+Status: Bogus
Bug Type: Strings related
Operating System: Debian with bpo backport
PHP Version: 5.2.0
New Comment:
>For some UTF-8 characters, htmlentities() returns...
>&#nnnn; ... when it should return ...&#nnnn;
As long as htmlentities() receives "&#nnnn;" as its argument, the
result would be "&#nnnn;".
Previous Comments:
------------------------------------------------------------------------
[2007-01-04 03:46:34] thedewi at hotmail dot com
Description:
------------
For some UTF-8 characters, htmlentities() returns...
&#nnnn;
... when it should return ...
&#nnnn;
The problem does not seem to occur in the punctuation or currency
subranges, but many subranges are affected including: drawing, greek,
cyrillic, hebrew.
It has been partially fixed in the past:
http://bugs.php.net/bug.php?id=11175
There has also been at least one other bug report, filed "Bogus"
without a very detailed explanation:
http://bugs.php.net/bug.php?id=27691
Presumably the above was a misunderstanding, but if you get the urge to
mark this bug as "Bogus", please explain it, because this behaviour
seems to result in unpredictable and ambiguous results (by which I mean
that applying a workaround will give false positives).
Reproduce code:
---------------
<?php
print 'Form:<form action="?" method="post"><input
type="text"
name="foo" size="80" value="' .
htmlentities(stripslashes($_POST['foo']), ENT_QUOTES, 'UTF-8') .
'"/></form>Thanks.';
?>
Expected result:
----------------
When I enter text into the input field, it should render a correctly
represented and escaped value in the resulting markup:
»¥Ω∏░☺ψЭש ك
Note: it seems this bug report form itself suffers from a similar
problem, so keep in mind that the above are unicode characters, not
HTML escapes.
Actual result:
--------------
ȴ&#8486;&#8719;&#9617;&#9786;&#968;&#1069;&#1513;
&#1603;
As you can see, the first few translations were correct, but the more
exotic ones failed.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=40017&edit=1