get_html_translation_table calls the ' ' instead of '
| Bug #25927 | get_html_translation_table calls the ' ' instead of ' | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Submitted: | 2003-10-20 17:53 UTC | Modified: | 2010-10-12 04:52 UTC |
|
||||||||||
| From: | acm at tweakers dot net | Assigned: | cataphract (profile) | |||||||||||
| Status: | Closed | Package: | Unknown/Other Function | |||||||||||
| PHP Version: | 4.3.3 | OS: | Linux | |||||||||||
| Private report: | No | CVE-ID: | None | |||||||||||
[2003-10-20 17:53 UTC] acm at tweakers dot net
Description:
------------
When you call get_html_translation_table, with the ENT_QUOTES parameter, it'll return ' for '
The code for ' should, of course, be '
This was not broken in 4.3.1, so is newly introduced in either 4.3.2 or 4.3.3
One wonders how this could occur, since both htmlspecialchars/htmlentities and html_entity_decode work correctly.
Reproduce code:
---------------
<? print_r(get_html_translation_table(HTML_SPECIALCHARS,ENT_QUOTES));
?>
Expected result:
----------------
Array
(
[&] => &
["] => "
['] => '
[<] => <
[>] => >
)
Actual result:
--------------
Array
(
[&] => &
["] => "
['] => '
[<] => <
[>] => >
)
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2003-10-20 18:35 UTC] kees at tweakers dot net
We've fixed it be commenting line 421 of ext/standard/html.c: 420- { '\'', "'", 6, ENT_HTML_QUOTE_SINGLE }, 421:/* { '\'', "'", 5, ENT_HTML_QUOTE_SINGLE }, */[2003-10-20 19:04 UTC] acm at tweakers dot net
[2003-10-20 21:51 UTC] moriyoshi@php.net
[2003-10-21 05:14 UTC] acm at tweakers dot net
Well, maybe so. But I was refering to a function that tries to undo the changes of htmlspecialchars/htmlentities. If htmlspecialchars changes ' to ' and you want to depend on get_html_translation_table to undo all changes, you expect it to return ' = ' instead of ' = ', since that's the change htmlspecialchars/htmlentities did aswell. It didn't change it to ' If you really wanted to create a perfect entity-decoder, you'd indeed have to cope with all those &*; entities, including all the &#[0-9]{2,3};-like entities. But for the simple "undo the htmlspecialchars"-like function that is not necessary. And again, get_html_translation_table returns "how the htmlspecialchars/entities functions do it", not "all possible translations" or "just a valid version, maybe not what our own functions do", doesn't it? :) To explain what I mean: if you do echo html_entity_decode(htmlspecialchars("'", ENT_QUOTES)); you get ' back. If you do: function my_entity_decoder($string) { $trans = array_flip(get_html_translation_table(ENT_HTML_SPECIALCHARS, ENT_QUOTES)); $original = strtr($encoded, $trans); } echo my_entity_decoder(htmlspecialchars("'", ENT_QUOTES)); Where you trust the get_html_translation_table-function to return enough information to output ' again... But if it all doesn't matter to you guys, why do the two change at all? Why does the htmlspecialchars change it to ' why the get_html_translation_table claims it changes it to ' ??[2003-11-20 14:00 UTC] mike-php at emerge2 dot com
[2010-10-11 07:15 UTC] cataphract@php.net
-Status: Bogus +Status: Re-Opened -Assigned To: +Assigned To: cataphract
[2010-10-12 04:51 UTC] cataphract@php.net