Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112619
MIME-Version: 1.0
References: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
In-Reply-To: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
Date: Sat, 26 Dec 2020 12:34:24 +0100
Message-ID: <CAJmy8YFr_Hc3xYpHahY+mVdN5Rcr-ihg2s+5x34VDH+gkpr4Kw@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000001536cc05b75c6dbe"
Subject: Re: [PHP-DEV] ENT_COMPAT for htmlentities and htmlspecialchars
From: divinity76@gmail.com (Hans Henrik Bergan)

--0000000000001536cc05b75c6dbe
Content-Type: text/plain; charset="UTF-8"

FWIW i'm surprised with the lack of ENT_DISALLOWED , personally i use
tohtml(string $str):string{ return htmlentities($str, ENT_QUOTES |
ENT_HTML401 | ENT_SUBSTITUTE | ENT_DISALLOWED, 'UTF-8', true);}

On Sat, 26 Dec 2020 at 12:03, Craig Francis <craig@craigfrancis.co.uk>
wrote:

> Hi,
>
> Could htmlspecialchars() use ENT_QUOTES by default?
>
> I recently worked on an example script, where I tried to keep it simple by
> using htmlspecialchars directly, e.g.
>
>     echo "<img src='" . htmlspecialchars($url) . "'>";
>
> I'd completely forgotten that single quotes are not escaped by default,
> creating a XSS vulnerability, e.g.
>
>     $url = "/' onerror='alert(1)";
>
> All the common frameworks I could find use ENT_QUOTES to do this safely
> (details below).
>
> Christoph (cmb69) suggests this was done for HTML4 compatibility, with
> older versions of PHP possibly having issues with numeric character
> references (a quick search suggests PHP 5.4?).
>
> PHP uses the numeric version &#039; with ENT_QUOTES, and it should continue
> to do so - because the named version, &apos; was added in HTML5, but can
> still cause problems with legacy parsers; for example Android 4, and the
> one still in use by Microsoft Outlook (&amp;/&gt;/&lt; was in the
> original HTML spec, and &quot; was added in HTML2).
>
> I'd also be tempted to suggest ENT_SUBSTITUTE should be included, as I
> prefer to keep as much of the valid data (rather than losing everything),
> but that's not as important as escaping the apostrophe by default.
>
> Craig
>
>
>
>
> WordPress uses ENT_QUOTES (ish).
>
> https://developer.wordpress.org/reference/functions/esc_html/
>
> Laravel, with Blade, uses ENT_QUOTES:
>
> https://github.com/illuminate/support/blob/master/helpers.php#L118
>
> Symfony or Slim, with Twig, uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L243
>
> CodeIgniter uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/codeigniter4/CodeIgniter4/blob/develop/system/ThirdParty/Escaper/Escaper.php#L120
>
> CakePHP uses ENT_QUOTES | ENT_SUBSTITUTE:
>
> https://github.com/cakephp/cakephp/blob/master/src/Core/functions.php#L67
>
> YII uses ENT_QUOTES | ENT_SUBSTITUTE:
>
>
> https://github.com/yiisoft/yii2/blob/master/framework/helpers/BaseHtml.php#L111
>
> Phalcon uses ENT_QUOTES:
>
> https://github.com/phalcon/phalcon/blob/v5.0.x/src/Html/Escaper.php#L78
>
> FuelPHP uses ENT_QUOTES:
>
> https://github.com/fuel/core/blob/1.9/develop/config/config.php#L459
>

--0000000000001536cc05b75c6dbe--