note 98202 added to function.htmlspecialchars-decode

[@Editors: Couldn't find this note on the mirrors, presuming it got dropped, so posting it again; was pretty sure legitimate posters get notified via e-mail if their note is dropped, thus presuming glitch. If I'm mistaken, please accept my apologies.] Please BE CAREFUL when using benharold at mac dot com's trick. As they themselves have said: "Now, if your dealing with text that is a mixed bag (has HTML entities and non-HTML entities) you're on your own." What does that mean? That means you should never trust user input to that function. Why? Well, take a look at this example: <?php $var = "&amp;<script>alert('XSS!');</script>"; $var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var; ?> htmlspecialchars_decode($var) will evaluate to "&<script>alert('XSS!');</script>", which is NOT the same as $var. Accordingly, $var will be returned raw (since the ternary operator routes to $var rather than htmlspecialchars($var)), even though it should be getting htmlspecialchars() sanitised. Echoing the string, which you might after that line presume to be htmlspecialchars() encoded, will thus open you to cross-site scripting. Unfortunately, there is no reliable way to check whether output has been sanitised or not that does not come with this caveat (that I know of). The only 'guard' against repeat-encoding your output is to exclusively do it as close to the final output as possible, e.g. if you have a MVC architecture, that you sanitise in the view itself. ---- Server IP: 69.147.83.197 Probable Submitter: 217.92.147.99 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars-decode.php Edit -- https://master.php.net/note/edit/98202 Del: integrated -- https://master.php.net/note/delete/98202/integrated Del: useless -- https://master.php.net/note/delete/98202/useless Del: bad code -- https://master.php.net/note/delete/98202/bad+code Del: spam -- https://master.php.net/note/delete/98202/spam Del: non-english -- https://master.php.net/note/delete/98202/non-english Del: in docs -- https://master.php.net/note/delete/98202/in+docs Del: other reasons-- https://master.php.net/note/delete/98202 Reject -- https://master.php.net/note/reject/98202 Search -- https://master.php.net/manage/user-notes.php