note 111864 added to domdocument.createattribute

This may be obvious to most people, but it gave me a few minutes of head-scratching before I figured it out, but ampersands need to be properly escaped as HTML entities. <?php $doc= new DOMDocument('1.0', "UTF-8"); $invalid_elem = $doc->createElement('field', 'incorrect attribute'); $invalid_attr = $doc->createAttribute('name'); $invalid_attr->value = 'foo&bar'; $invalid_elem->appendChild($invalid_attr); $doc->appendChild($invalid_elem); $valid_elem = $doc->createElement('field', 'correct attribute'); $valid_attr = $doc->createAttribute('name'); $valid_attr->value = 'foo&amp;bar'; $valid_elem->appendChild($valid_attr); $doc->appendChild($valid_elem); ?> Will output: <?xml version="1.0" encoding="UTF-8"?> <field name="foo">incorrect attribute</field> <field name="foo&bar">correct attribute</field> As near as I can figure out, no exception is thrown for an invalid attribute. This will affect DOMDocuments created as HTML as well as XML. ---- Server IP: 69.147.83.199 Probable Submitter: 109.232.57.247 ---- Manual Page -- http://php.net/manual/en/domdocument.createattribute.php Edit -- https://master.php.net/note/edit/111864 Del: integrated -- https://master.php.net/note/delete/111864/integrated Del: useless -- https://master.php.net/note/delete/111864/useless Del: bad code -- https://master.php.net/note/delete/111864/bad+code Del: spam -- https://master.php.net/note/delete/111864/spam Del: non-english -- https://master.php.net/note/delete/111864/non-english Del: in docs -- https://master.php.net/note/delete/111864/in+docs Del: other reasons-- https://master.php.net/note/delete/111864 Reject -- https://master.php.net/note/reject/111864 Search -- https://master.php.net/manage/user-notes.php