#43896 [Asn->Tbd]: htmlspecialchars() returns empty string on invalid unicode sequence

From: Date: Wed, 26 Nov 2008 04:33:22 +0000
Subject: #43896 [Asn->Tbd]: htmlspecialchars() returns empty string on invalid unicode sequence
References: 1  Groups: php.bugs php.doc.bugs 
Request: Send a blank email to php-bugs+get-131337@lists.php.net to get a copy of this message 
 ID:               43896
 Updated by:       lbarnaud@php.net
 Reported By:      arnaud dot lb at gmail dot com
-Status:           Assigned
+Status:           To be documented
 Bug Type:         Strings related
 Operating System: *
 PHP Version:      5CVS-2008-07-15
 New Comment:

It seems "Fixed in CVS and need to be documented" does not changes the
status if it is set to "Assigned" :/


Previous Comments:
------------------------------------------------------------------------

[2008-11-26 04:31:24] lbarnaud@php.net

 

------------------------------------------------------------------------

[2008-11-26 04:30:41] lbarnaud@php.net

Added ENT_IGNORE as a compatibility flag to skip invalid multibyte
sequences instead of returning an empty string (as iconv's //IGNORE).
These functions will still never return an invalid or incomplete
multibyte sequence.
Example: htmlspecialchars("...", ENT_QUOTES | ENT_COMPAT, "utf-8");

------------------------------------------------------------------------

[2008-11-02 13:27:46] jani@php.net

Arnaud, fix it yourself.

------------------------------------------------------------------------

[2008-10-21 12:08:38] jani@php.net

Actually "The tool" to use for incoming data is the filter extension..

------------------------------------------------------------------------

[2008-09-11 12:52:16] yunosh@php.net

Not considering this as a bug (or rather a regression) is a major flaw
IMO.
htmlspecialchars() is *THE* tool that developers are encouraged to use
when escaping output of data that comes from an unknown source. By
nature you can't always rely on this data to be perfectly valid. People
copy and paste from Word to HTML forms and do all kind of weird stuff to
get data into a website.
Simply discarding the complete data just because it's not a completely
valid character stream is going break all kind of websites with user
generated content.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/43896

-- 
Edit this bug report at http://bugs.php.net/?id=43896&edit=1

Thread (24 messages)

« previous php.bugs (#131337) next »