note 116535 deleted from function.htmlspecialchars-decode by tularis

Note Submitter: patrice dot leblanc dot pro at gmail dot com ---- For the famous problem of '&'... I was disturbed with pinkgothic at gmail dot com but i wanted to find why. (...noob ^^) In fact, if 'encode()' is on the setter, the object will be created, and encoded before to be registered. (expected behavior, at the beginning) But, when you take/create the object from the database, it will be encoded again ! (and 'decode()' resolve this stuff... ^^) If you print your String on the screen, there will be two ways : 1) Your object is encoded twice (because it comes from database) : You NEED to 'decode()', only once, to print it on screen. Warning : if you 'decode()' twice, XSS is open. 2) Your object is encoded once (because it is'nt an object from database) You DON'T NEED to 'decode()', the browser will translate and print it on the screen (it's his job). However, depending of the origin of your object, it will be different ! An 'encoded()' from your code, and an 'encoded(encoded())' from the manager, then, the comparisons will be problematic... ... unless you work ONLY with objects from database... even if you have just created one, you will have to recover it with your manager. And then, you will decode() all of them to print them on the screen. Please mail me if i'm wrong. Sorry for my poor english. (... French noob ^^)