Bug #61354 [Nab]: htmlentities and htmlspecialchars doesn't respect the default_charset

From: Date: Sat, 05 Jan 2013 15:17:56 +0000
Subject: Bug #61354 [Nab]: htmlentities and htmlspecialchars doesn't respect the default_charset
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-175756@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=61354&edit=1

 ID:                 61354
 Updated by:         rasmus@php.net
 Reported by:        hufeng1987 at gmail dot com
 Summary:            htmlentities and htmlspecialchars doesn't respect
                     the default_charset
 Status:             Not a bug
 Type:               Bug
 Package:            Strings related
 Operating System:   Linux/Windows/
 PHP Version:        5.4.0
 Block user comment: N
 Private report:     N

 New Comment:

I have explained that a few times. We can't default it automatically because the  
encoding may not match the output encoding. Only the developer knows that. If we 
did that automatically it would break even more sites. The sites where the 
encodings differ need to set it explicitly.


Previous Comments:
------------------------------------------------------------------------
[2013-01-05 09:54:44] hufeng1987 at gmail dot com

pass null and empty string that could improve security? no sense..

------------------------------------------------------------------------
[2013-01-05 09:53:01] x dot bazilio at gmail dot com

Please, fix it.
It is so simple to provide default params. Wy should we put NULL and empty 
string? Where is security problem to not put NULL and empty string if they are 
will be default values of that params?

------------------------------------------------------------------------
[2013-01-05 04:40:26] rasmus@php.net

Code that is currently likely to be insecure, yes. We only make changes like this 
when we are forced to for security reasons.

------------------------------------------------------------------------
[2013-01-05 04:26:39] hufeng1987 at gmail dot com

you made one step, but kill the php programmer.

do you know how much more code need to rewrite and check?

if your change broken user programm, it's your lost, not the user's lost.

------------------------------------------------------------------------
[2013-01-05 04:20:02] rasmus@php.net

You will need to update your code to be compatible with PHP 5.4 either by 
explicitly providing the charset, or by passing in "" to pick up the default one. 
Anything short of that is a security issue. Code that didn't do this in PHP 5.3 
is potentially insecure depending on which charset is being used, so no, nothing 
will be fixed here. We will not revert to 5.3 behaviour.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=61354


-- 
Edit this bug report at https://bugs.php.net/bug.php?id=61354&edit=1

Thread (44 messages)

« previous php.bugs (#175756) next »