Edit report at https://bugs.php.net/bug.php?id=61354&edit=1
ID: 61354
Comment by: support at playnext dot ru
Reported by: hufeng1987 at gmail dot com
Summary: htmlentities and htmlspecialchars doesn't respect
the default_charset
Status: Not a bug
Type: Bug
Package: Strings related
Operating System: Linux/Windows/
PHP Version: 5.4.0
Block user comment: N
Private report: N
New Comment:
For those still looking for a solution around this headache - pls consider:
1. http://php.net/manual/en/function.override-function.php
2. http://php.net/manual/ru/function.runkit-function-redefine.php
The idea - you override the built-in htmlspecialchars() function with your customized variant which
is able to respect non UTF-8 default encoding. This small piece of code can be then easily inserted
somewhere at the start of yout project. No need to rewrite all htmlspecialchars() entries globally.
I've spent several hours with both approaches. Variant 1 looks good especaially in combination
with http://www.php.net/manual/en/function.rename-function.php
as it allows to call original htmlspecialchars() with just altered default args. The code could be
as follows:
rename_function('htmlspecialchars', 'renamed_htmlspecialchars');
function overriden_htmlspecialchars($string, $flags=NULL, $encoding='cp1251',
$double_encode=true) {
$flags = $flags ? $flags : (ENT_COMPAT|ENT_HTML401);
return renamed_htmlspecialchars($string, $flags, $encoding, $double_encode);
}
override_function('htmlspecialchars', '$string, $flags, $encoding,
$double_encode', 'return overriden_htmlspecialchars($string, $flags, $encoding,
$double_encode);');
?>
Unfortunatelly this didn't work for me properly - my site managed to call overriden function
but not every time I reloaded the pages. Moreover other PHP sites crashed under my Apache server as
they suddenly started blaming htmlspecialchars() was not defined. I suppose I had to spend more time
to make it work thread/request/site/whatever-safe.
So I switched to runkit (variant 2). It worked for me, although even after trying
runkit_function_rename()+runkit_function_add() I didn't managed to recall original
htmlspecialchars() function. So as a quick solution I decided to call htmlentities() instead:
<?php
function overriden_htmlspecialchars($string, $flags=NULL, $encoding='UTF-8',
$double_encode=true) {
$flags = $flags ? $flags : (ENT_COMPAT|ENT_HTML401);
$encoding = $encoding ? $encoding : 'cp1251';
//return renamed_htmlspecialchars($string, $flags, $encoding, $double_encode);
return htmlentities($string, $flags, $encoding, $double_encode);
}
runkit_function_redefine('htmlspecialchars', '$string, $flags, $encoding,
$double_encode', 'return overriden_htmlspecialchars($string, $flags, $encoding,
$double_encode);');
?>
You may be able to implement your more powerfull overriden function.
Sorry, if this topic is not bug-related. I support all the reports here - a small update to the
default behaviour ruined our days...
Thank you.
Previous Comments:
------------------------------------------------------------------------
[2013-09-17 08:48:26] b83 at yandex dot ru
Moreover it will be impossible to upgrade to newer OS versions and use PHP versions from distro.
Which is even more a security issue.
http://askubuntu.com/questions/306487/install-php-5-3-on-ubuntu-13-04
------------------------------------------------------------------------
[2013-07-25 19:18:45] ab@php.net
Related To: Bug #63426
------------------------------------------------------------------------
[2013-07-20 12:49:28] stemind at gmail dot com
Zend should be convinced. The Zend htmlspecialchars Initiative
http://ufive.ch/tzhi/
------------------------------------------------------------------------
[2013-07-12 13:15:06] kstirn at gmail dot com
Instead of moving on to PHP 5.4 and PHP 5.5 thousands of servers will stay with legacy PHP 5.3 due
to this single, easy to solve (ini setting) issue that the PHP team has decided to ignore.
------------------------------------------------------------------------
[2013-07-12 10:57:40] tototation at gmail dot com
Yes, i'm interested too to understand that fact.
I recently upgrade my server, and ALL my code is unusable !
A search in code found +470 000 words htmlentities or htmlspecialchars !!!!!
HOW TO CHANGE ALL THIS ????? THAT'S IMPOSSIBLE !!!!!!!!
Thanks, we must stop all our services and websites.
Just for a stupid thing.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=61354
--
Edit this bug report at https://bugs.php.net/bug.php?id=61354&edit=1