Req #69450 [Wfx]: Default to ENT_SUBSTITUTE for htmlspecialchars()

Edit report at https://bugs.php.net/bug.php?id=69450&edit=1 ID: 69450 User updated by: olafvdspek at gmail dot com Reported by: olafvdspek at gmail dot com Summary: Default to ENT_SUBSTITUTE for htmlspecialchars() Status: Wont fix Type: Feature/Change Request Package: Output Control PHP Version: Irrelevant Block user comment: N Private report: N New Comment: If that's the case wouldn't it be even better to halt the script? Returning empty strings ALSO has the risk of broken output. Even worse, broken output is basically guaranteed. Previous Comments: ------------------------------------------------------------------------ [2015-04-14 19:52:03] yohgaki@php.net Replacing any invalid byte sequence in string has risk of broken output. i.e. Broken html structures, etc. If you would not want to have empty outputs from htmlspecialchars, validate all of your inputs. You can replace invalid multibyte sequence optionally. i.e. Use mb_convert_encoding(). This is the optimal way to handle text. ------------------------------------------------------------------------ [2015-04-14 17:50:31] olafvdspek at gmail dot com Description: ------------ Could you default to ENT_SUBSTITUTE for htmlspecialchars()? Returning an empty string seems sub-optimal. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69450&edit=1