Re: PHP 4.0 Bug #6696 Updated: htmlentities does not encode apostrophe

On Wed, Sep 13, 2000 at 02:42:14AM -0000, Bug Database wrote: > Updated by: derick > I'll have a look at it sometime. I've been following the htmlentities/htmlspecialchars discussions with interest. My two cents... The following is an opinion only, flames will not be appreciated. Don't bother pointing out minor errors, I wrote this quite quickly. Above all, discuss, don't ignore. YMMV. According to the RFC1866 spec 'HTML 2.0' specification it says, in section 3.2.1, that for translating plain text to HTML the only three characters you need to entity encode are: ENTITY NUMERIC CHARACTER REFERENCE CHAR REF CHARACTER DESCRIPTION --------- ---------- ----------- --------------------- & &amp; &#38; Ampersand < &lt; &#60; Less than > &gt; &#62; Greater than The htmlspecialchars function, however, encodes four characters. Those characters are the ones listed above and also the double quote character. The comment supplied in the current documentation for the PHP function htmlspecialchars says that its purpose is for "preventing user-supplied text from containing HTML markup". As you can see from RFC1866 the double quote character does not need to be encoded in user-supplied text, so at first glance it seems very strange that the PHP function would encode this character. That is, until you realise that the htmlspecialchars function can also be used to encode strings for inclusion as part of an HTML attribute. An HTML attribute is usually surrounded in double quotes, e.g.: <IMG SRC="image.jpg" alt="First &quot;real&quot; example"> Where the double quotes need to be encoded within the surrounding quotes. This makes the htmlspecialchars function twice as useful, as it can now be used for both HTML elements and HTML attributes. The above example was taken from RFC1866, another one shows the use of single quotes around an HTML attribute: <img src='http://host/dir/file.gif'> The point of this example is that it is equally valid to use either double or single quotes in an HTML attribute. This is documented in RFC1866 in section 3.2.4: * A string literal, delimited by single quotes or double quotes and not containing any occurrences of the delimiting character. The problem with the PHP function is that by encoding double quotes, in addition to the 3 HTML special characters, the function now either does too much or two little, depending on your perspective. If you think that this function should be encoding just the bare minimum for an HTML element then it does too much - it should only be doing the three HTML special characters. If you think that this function should be encoding for use in both HTML elements and HTML attributes, this function does too little - it should be encoding the three special characters and both quote styles. Some people might say that nobody uses the single quote style - a quick check reveals even the www.php.net pages do. Hopefully you can see the logic that either htmlspecialchars should encode BOTH quote characeters, or it shouldn't encode either. The problem now: For the astute HTML programmer, the oddity in htmlspecialentities() would have been noticed the first time the documentation was read. Many programmers would probably ignore this problem as they only use double quotes. However, the clever ones would have switched to htmlentities() as this encodes the single quote character in addition to the special characeters. I call the programmer "clever" here because by using htmlentities() instead of htmlspecialchars() they have protected themselves against the situation where they are working with automatically-produced (e.g. from a design pacakge) that uses single quotes instead of double quotes. Humans make mistakes, and by always using htmlentities() they don't make that mistake. The problem with that, is that as of the current CVS, the single quote character is no longer encoded in the htmlentities() function (see editors note at bottom of documentation - I've not checked it). This change is likely to break many many web pages. There will be another load of programmers that also noticed the oddity in htmlspecialentities() and decided to work around the problem by doing a regex translation of single quotes, before calling htmlspecialentities() with the result. This action means that htmlspecialentities() should not be changed to quote single quotes. Opinion: This is a complete mess. How programmers are expected to cope I don't understand. If the editors note at the bottom of the documentation for htmlentities() is correct, the latest cvs version will break a *lot* of pages moving from PHP3 to PHP4, and frankly I think the PHP3 behavour is more correct. Suggestion: Change htmlentities so that it behaves as of PHP 3 and PHP 4.0.2. Add parameter to htmlspecialchars so that the behavour can be specified. Perhaps something like: htmlspecialchars() - quote the 3 specials and also " htmlspecialchars(SC_BOTHQUOTE) - quote both htmlspecialchars(SC_DOUBLEQUOTE) - quote just double Best wishes, James -- James Ponder; Oaktree/IS4B Ltd., (024) 7663 3177; http://www.squish.net/