note 71268 added to function.html-entity-decode

You should be aware that this function has a severe security bug in it in unpatched php versions < 4.4.3 and < 5.1.3. On those systems, it it should not be used to process user inputs. For broad systems usage (lots of hosters don't have this patch or up-to-date versions yet), it should not be used to process user inputs, as it can provide (and i've seen this) exposure of random (actually not so random, since it's recently used content in memory !) memory content, related to your website (like private pages just generated, like source code, passwords etc). Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1490 ---- Server IP: 64.71.164.2 Probable Submitter: 193.5.2.218 ---- Manual Page -- http://www.php.net/manual/en/function.html-entity-decode.php Edit -- https://master.php.net/note/edit/71268 Del: integrated -- https://master.php.net/note/delete/71268/integrated Del: useless -- https://master.php.net/note/delete/71268/useless Del: bad code -- https://master.php.net/note/delete/71268/bad+code Del: spam -- https://master.php.net/note/delete/71268/spam Del: non-english -- https://master.php.net/note/delete/71268/non-english Del: in docs -- https://master.php.net/note/delete/71268/in+docs Del: other reasons-- https://master.php.net/note/delete/71268 Reject -- https://master.php.net/note/reject/71268 Search -- https://master.php.net/manage/user-notes.php