Re: [PATCH] Bug #43896 htmlspecialchars returns empty stringon invalid unicode sequence

On Fri, 25 Jan 2008 14:22:52 -0800, in php.internals stas@zend.com (Stanislav Malyshev) wrote: >> Should really theses functions discard the whole string for a single >> incomplete sequence ? > >I think since it is not possible to recover true content of the string, >it is ok to return failure value. Cutting it in random places or >ignoring problems doesn't seem a good idea - it might lead to all kinds >of nasty things, such as security filtering checking one data and >database getting entirely different data. On the other hand utf8_decode() also expects the input to be UTF-8 encoded, but it replaces incomplete sequences with the character "?". I don't know if it is a recommended standard for invalid input but I have seen this conversion as well in a couple of other applications, e.g. Firefox. -- - Peter Brodersen