note 125979 added to function.htmlspecialchars
| From: | ASchmidt at Anamera dot net | Date: | Fri, 02 Apr 2021 20:48:37 +0000 |
| Subject: | note 125979 added to function.htmlspecialchars | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-219166@lists.php.net to get a copy of this message | ||
One MUST specify ENT_HTML5 in addition to double_encode=false to avoid double-encoding.
The reason is that contrary to the documentation, double_encode=false will NOT unconditionally and
globally prevent double-encoding of ALL existing entities. Crucially, it will only skip
double-encoding for THOSE character entities that are explicitly valid for the document type chosen!
Since ENT_HTML5 references the most expansive list of character entities, it is the only setting
that will be most lenient with existing character entities.
<?php
declare(strict_types=1);
$text = 'ampersand(&), double quote("), single quote('), less
than(<), greater than(>), numeric
entities(&"'<>), HTML 5
entities(+,!$(ņ€)';
$result3 = htmlspecialchars( $text, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8',
/*double_encode*/false );
$result4 = htmlspecialchars( $text, ENT_NOQUOTES | ENT_XML1 | ENT_SUBSTITUTE, 'UTF-8',
/*double_encode*/false );
$result5 = htmlspecialchars( $text, ENT_NOQUOTES | ENT_XHTML | ENT_SUBSTITUTE, 'UTF-8',
/*double_encode*/false );
$result6 = htmlspecialchars( $text, ENT_NOQUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8',
/*double_encode*/false );
echo "<br />\r\nHTML 4.01:<br />\r\n", $result3,
"<br />\r\nXML 1:<br />\r\n", $result4,
"<br />\r\nXHTML:<br />\r\n", $result5,
"<br />\r\nHTML 5:<br />\r\n", $result6, "<br />\r\n";
?>
will produce:
HTML 4.01 (will NOT recognize single quote, but Euro):
ampersand(&), double quote("), single quote('), less than(<), greater
than(>), numeric entities(&"'<>), HTML 5
entities(+,!$(ņâ¬)
XML 1 (WILL recognize single quote, but NOT Euro):
ampersand(&), double quote("), single quote('), less than(<), greater than(>),
numeric entities(&"'<>), HTML 5
entities(+,!$(ņ€)
XHTML (recognizes single quote and Euro):
ampersand(&), double quote("), single quote('), less than(<), greater than(>),
numeric entities(&"'<>), HTML 5
entities(+,!$(ņâ¬)
HTML 5 (recognizes "all" valid character entities):
ampersand(&), double quote("), single quote('), less than(<), greater than(>),
numeric entities(&"'<>), HTML 5 entities(+,!$(Åâ¬)
----
Server IP: 45.112.84.4
Probable Submitter: 45.112.85.242 (proxied: 206.128.157.247)
----
Manual Page -- http://php.net/manual/en/function.htmlspecialchars.php
Edit -- https://master.php.net/note/edit/125979
Del: integrated -- https://master.php.net/note/delete/125979/integrated
Del: useless -- https://master.php.net/note/delete/125979/useless
Del: bad code -- https://master.php.net/note/delete/125979/bad+code
Del: spam -- https://master.php.net/note/delete/125979/spam
Del: non-english -- https://master.php.net/note/delete/125979/non-english
Del: in docs -- https://master.php.net/note/delete/125979/in+docs
Del: other reasons-- https://master.php.net/note/delete/125979
Reject -- https://master.php.net/note/reject/125979
Search -- https://master.php.net/manage/user-notes.php