[php-src] Issue #15224: htmlspecialchars() - discrepancies with the documentation

Issue: https://github.com/php/php-src/issues/15224 Author: KhamaleonStudio **htmlspecialchars()** There are discrepancies with the documentation and the obtained results. Summary of observations on htmlspecialchars(): 1. Observed behavior: - htmlspecialchars() does not visually convert special characters into HTML entities as described in the documentation. - Escaped HTML and JavaScript are displayed as plain text in the browser, without converting into visible HTML entities. 2. Tests conducted: - Tested in multiple environments: local servers, cloud hosting, and Replit. - Used different versions of PHP, including 8.1.2. - Tested with various types of input, including simple HTML and JavaScript scripts. 3. Test results: - Example: htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES) displays <a href='test'>Test</a> in the browser, not the expected HTML entities. - Potentially malicious scripts and HTML do not execute, confirming the security functionality. - The page source code shows the text unescaped, the same as in the browser display. 4. Security functionality: - Despite the visual discrepancy, the function effectively prevents the execution of unwanted HTML and JavaScript code. - Script injection tests confirm that htmlspecialchars() still provides protection against XSS. 5. Consistency: - This behavior is consistent across different environments and PHP versions tested. 6. Discrepancy with the documentation: - The current PHP documentation suggests that special characters should visually convert into HTML entities, which does not happen in practice. Conclusion: Although htmlspecialchars() fulfills its primary security function, its visual behavior significantly differs from what is described in the official PHP documentation. This can cause confusion among developers and warrants a review of the documentation or an explanation of the observed behavior.