note 98133 added to function.htmlspecialchars-decode

Crikey. Hope the I'm not too late to save the unwitting with this. :( In response to benharold at mac dot com: Try the string "&amp;<script>alert('XSS');</script>". Your code will establish that the decoded string "&<script>alert('XSS');</script>" does not match the original string "&amp;<script>alert('XSS');</script>", presume it is already encoded, and then output the raw variable. In other words, unfortunately, it *will* screw you, albeit in a different fashion than one might have been looking to avoid. It'll leave you wide open. There is unfortunately no way to test if a string is already encoded that does not come with these caveats that I know of. I know accidentally double-encoding is a pain, but the solution really just is to escape as close to your actual output as you can muster (in an MVC structure, by escaping in the view) and not before then. ---- Server IP: 217.160.235.204 Probable Submitter: 217.92.147.99 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars-decode.php Edit -- https://master.php.net/note/edit/98133 Del: integrated -- https://master.php.net/note/delete/98133/integrated Del: useless -- https://master.php.net/note/delete/98133/useless Del: bad code -- https://master.php.net/note/delete/98133/bad+code Del: spam -- https://master.php.net/note/delete/98133/spam Del: non-english -- https://master.php.net/note/delete/98133/non-english Del: in docs -- https://master.php.net/note/delete/98133/in+docs Del: other reasons-- https://master.php.net/note/delete/98133 Reject -- https://master.php.net/note/reject/98133 Search -- https://master.php.net/manage/user-notes.php