Re: note 8373 added to htmlspecialchars

"J. M. Castagnetto" <jcastagnetto@yahoo.com> wrote: > > This change has however been reverted because it broke too many existing > > apps. We either need a separate function or an optional second argument > > to enable this. What kind of code did it break? I can't imagine how someone could rely on it not escaping single quotes. Maybe a new function called htmlsafe, or something? Its behaviour would be to guarantee that the text it returned would be safe to include in HTML text or as an attribute value between quotes, with no side effects. > If what you want is to get the single quote entity, > why not just use htmlentities()? If htmlentities() performs as per its documentation, then it does not escape single quotes, as there is not a named entity for single quotes. Besides which (actually, htmlentities does encode single quotes - I have added a note to its manual page to this effect), htmlspecialchars is not achieving its specified aim (to encode characters which are 'special' to HTML) unless it is escaping single quotes. > Having the single quote entity will be a nicety for > fixing old/bad HTML, or when dealing w/ XML w/ a > strict DTD, othewise I do not see the point. What has old/bad HTML got to do with it? Single quotes have been a valid attribute quote character from the earliest HTML spec (well, 2.0 definitely, and probably earlier) until the latest, 4.0.1. > The text in your previous note said (verbatim): > > str_replace("'", "'", htmlspecialchars($foo)) When I wrote it, the second quote character was ampersand-hash-3-9-semicolon. The add-note system must have mangled it before emailing it. (That's why I spelled it out in the new note I added.) > Explain to me more clearly why is this such an > important need, perhaps I am missing something that > you did (or did not) mention in your previous note. htmlspecialchars is not achieving its intended purpose as it currently stands. This is presumably why it was changed to escape single quotes also, before that code was removed. So, the situation as it currently stands is that the function is slightly broken. The problem is not particularly serious, because the function has good documentation which correctly shows what it actually does (otherwise it would be a security issue). It would be nice to have a function which did the Right Thing though, and a note on the htmlspecialchars manual page explaining that the function doesn't quite do what it should (which is why I added one). Cheers Jon