Bug #74371 [Com]: strip_tags altering attributes
Edit report at https://bugs.php.net/bug.php?id=74371&edit=1
ID: 74371
Comment by: spam2 at rhsoft dot net
Reported by: php-bugs at aspectis dot net
Summary: strip_tags altering attributes
Status: Open
Type: Bug
Package: *General Issues
PHP Version: 7.1.3
Block user comment: N
Private report: N
New Comment:
your source code is just plain wrong when it contains < or > because these chars needs to be
encoded as entities and the whole purpose of strip_tags() is to FIX such issues to PREVENT that your
tag itself get closed by unencoded value
Previous Comments:
------------------------------------------------------------------------
[2017-04-04 18:41:26] php-bugs at aspectis dot net
Description:
------------
The manual claims that strip_tags "does not modify any attributes on the tags that you
allow" (http://www.php.net/function.strip-tags), which unfortunately isn't quite true:
The characters "<" and ">" get stripped from all attribute values.
All versions at least from 5.4 seem to be affected.
Test script:
---------------
echo strip_tags('<img src="example.jpg" alt=":> :<">',
'<img>');
Expected result:
----------------
<img src="example.jpg" alt=":> :<">
Actual result:
--------------
<img src="example.jpg" alt=": :">
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74371&edit=1
Thread (7 messages)