Re: strip_tags bug or intended behavior?

On 28/02/2024 20:04, Alan Nelson wrote:

Passing the below example into strip_tags fails because "n<a.length" in the JavaScript is interpreted as an opening tag. All content after "<a.length" is removed. Does this seem like a bug or intended behavior? On one hand it seems like a bug because this is valid HTML, but on the other hand strip_tags is not documented as supporting JavaScript or intended for it.

A little of both. strip_tags is a naive implementation. It looks like it's assuming the <a is the start of a link tag here. strip_tags doesn't actually try to parse the content using full HTML rules, as per the notes on the manual page: https://www.php.net/strip_tags#refsect1-function.strip-tags-notes This is one of the reasons it's generally advised to avoid strip_tags. To correctly handle HTML content you should use the DOM extension (or another HTML parser). There's a possibility someone may look at this if you file an issue on PHP's GitHub tracker but it's equally possible it may just get closed with a "won't fix" due to strip_tags nature. https://github.com/php/php-src/issues Personally I would file a separate issue on the Laravel project. While it's documented that assertSeeText relies on strip_tags, that's probably not really a good idea in my opinion: https://laravel.com/docs/10.x/http-tests#assert-see-text This issue can be worked around by putting spaces around the < in the JS code: https://3v4l.org/VZ6t6