note 68667 deleted from ref.simplexml by didou

Note Submitter: Rowan Lewis ---- Unfortunately for a project I was writing which used Tidy and SimpleXML to grant complete control to the developer over and HTML content passed by users, SimpleXML doesn't maintain the original structure of the input. What I mean by this is that when you use AsXML() to grab the XML of an element, if the element contains children other than text, SimpleXML changes the indentation. So any code like this: <a href="java script:alert('1');"><b>Item Two</b></a> Will come out like this: <a href="java script:alert('1');"> <b>Item Two</b> </a> Which, if you are using a find/replace routine, will cause it to fail. In our case, it caused it to fail, and pass malicious code.