Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

htmlspecialchars can't escape " and ' in xml context

i am trying to escape 5 characters " ‘ < > & in xml context:

the problem is when i check the page source only < > and & is converted as expected to &lt; &gt; and &amp; but " and ‘ remians without change.

the php code is:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

    $xml = new DOMDocument("1.0", "UTF-8");
    $rss = $xml->createElement("rss");
    $rssNode = $xml->appendChild($rss);
    $rssNode->setAttribute("version", "2.0");
    $xmlChannel = $xml->createElement("channel");
    $rssNode->appendChild($xmlChannel);
    $title = $xml->createElement("title", htmlspecialchars(" < > & ' " . '"', ENT_QUOTES | ENT_XML1, 'UTF-8'));
    $xmlChannel->appendChild($title);
    \Yii::$app->response->format = \yii\web\Response::FORMAT_XML;
    echo $xml->saveXML();

if i change my code to this – not xml context- all 5 special characters are changed:

function() {
return htmlspecialchars(" < > & '" . '"', ENT_QUOTES | ENT_XML1, 'UTF-8');
}

why this happens? how can i escape all 5 characters?

>Solution :

createElement normalises the value.

" and ' don’t need to be escaped because they have no special meaning outside of attribute values delimited with those characters.

You don’t need to escape them, just don’t worry about it.

Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading