[php-src] PR #23957: ext/standard: Return the input of htmlspecialchars() when nothing needs encoding

From: Date: Mon, 28 Sep 2026 07:25:09 +0000
Subject: [php-src] PR #23957: ext/standard: Return the input of htmlspecialchars() when nothing needs encoding
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38872@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23957 Author: nicolas-grekas htmlspecialchars() allocates a buffer of twice the input and decodes it character by character, even when the result is the input itself. That's the common case for template engines that escape every value they print. This scans the input first, with SSE2 (or NEON via zend_simd.h) on 16-byte blocks, and returns the input string when nothing needs encoding, as html_entity_decode() and htmlspecialchars_decode() already do since 68dc7549988. Otherwise, encoding starts after the scanned part, so strings that need escaping don't pay twice. On the Symfony Demo blog page, which makes 711 calls per request, htmlspecialchars() becomes about 3.5 times cheaper. The fast path doesn't apply with ENT_DISALLOWED, nor to htmlentities() unless it falls back to the basic entities. Bytes above 0x7F go through the same UTF-8 decoder as before. The IS_STR_VALID_UTF8 flag isn't used because mbstring can set it on strings that hold encoded surrogates (e.g. mb_convert_encoding() from UCS-4), which htmlspecialchars() rejects. The @refcount 1 annotations are removed since both functions can now return their argument.

« previous php.git-pulls (#38872) next »