[php-src] PR #23957: ext/standard: Return the input of htmlspecialchars() when nothing needs encoding
| From: | nicolas-grekas | Date: | Mon, 28 Sep 2026 07:25:09 +0000 |
| Subject: | [php-src] PR #23957: ext/standard: Return the input of htmlspecialchars() when nothing needs encoding | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38872@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23957
Author: nicolas-grekas
htmlspecialchars() allocates a buffer of twice the input and decodes it character by character, even
when the result is the input itself. That's the common case for template engines that escape
every value they print.
This scans the input first, with SSE2 (or NEON via zend_simd.h) on 16-byte blocks, and returns the
input string when nothing needs encoding, as html_entity_decode() and htmlspecialchars_decode()
already do since 68dc7549988. Otherwise, encoding starts after the scanned part, so strings that
need escaping don't pay twice. On the Symfony Demo blog page, which makes 711 calls per
request, htmlspecialchars() becomes about 3.5 times cheaper.
The fast path doesn't apply with ENT_DISALLOWED, nor to htmlentities() unless it falls back to
the basic entities. Bytes above 0x7F go through the same UTF-8 decoder as before. The
IS_STR_VALID_UTF8 flag isn't used because mbstring can set it on strings that hold encoded
surrogates (e.g.
mb_convert_encoding() from UCS-4), which htmlspecialchars() rejects.
The @refcount 1 annotations are removed since both functions can now return their
argument.