note 120696 deleted from function.htmlspecialchars by cmb
| From: | cmb@php.net | Date: | Sun, 27 Oct 2019 09:11:31 +0000 |
| Subject: | note 120696 deleted from function.htmlspecialchars by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-212833@lists.php.net to get a copy of this message | ||
Note Submitter: cj3 at clifjackson dot net
----
A nuanced quirk of this family of functions:
My understanding is that anything that is not in the translation table is considered invalid.
Consider this scenario:
<?php
$a = 'Â '; // a UTF-8 non-breaking space (on Mac OS X press option + space bar, or
\xc2\xa0 or \u00A0 )
$localeString = 'cs_CZ';
$oldLocale = setlocale(LC_ALL, '0');
$setLocale = setlocale(LC_ALL, $localeString);
$localeInfo = localeconv();
print_r($localeInfo);
Array
(
[decimal_point] => ,
[thousands_sep] => ?
[int_curr_symbol] => CZK
[currency_symbol] => K?
[mon_decimal_point] => ,
[mon_thousands_sep] => ?
[positive_sign] =>
[negative_sign] => -
[int_frac_digits] => 2
[frac_digits] => 2
[p_cs_precedes] => 0
[p_sep_by_space] => 1
[n_cs_precedes] => 0
[n_sep_by_space] => 1
[p_sign_posn] => 1
[n_sign_posn] => 1
[grouping] => Array
(
[0] => 3
[1] => 3
)
[mon_grouping] => Array
(
[0] => 3
[1] => 3
)
)
?>
We're concerned with all of the '?' in the above array. This is actually the UTF-8
non-breaking space that gets blitzed when you pass it through these functions. You get an empty
string back indicating an invalid code point.
I think it's odd that this is not converted in to the HTML entity equivalent .
So I had to do it manually with:
<?php
$newString = preg_replace('/[\xc2\xa0]+', ' ', $input);
?>