Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112794
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\))
In-Reply-To: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
Date: Thu, 7 Jan 2021 15:11:21 +0100
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <A2872D6A-CABE-442E-BEF6-33ED06EB3FB5@gmail.com>
References: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
To: Craig Francis <craig@craigfrancis.co.uk>
Subject: Re: [PHP-DEV] ENT_COMPAT for htmlentities and htmlspecialchars
From: claude.pache@gmail.com (Claude Pache)

Hi,

> Le 26 d=C3=A9c. 2020 =C3=A0 12:02, Craig Francis =
<craig@craigfrancis.co.uk> a =C3=A9crit :
>=20
> (...)
> PHP uses the numeric version &#039; with ENT_QUOTES, and it should =
continue
> to do so - because the named version, &apos; was added in HTML5, but =
can
> still cause problems with legacy parsers; for example Android 4, and =
the
> one still in use by Microsoft Outlook (&amp;/&gt;/&lt; was in the
> original HTML spec, and &quot; was added in HTML2).
>=20
> (...)

I agree that =E2=80=94 in addition to ENT_QUOTES =E2=80=94 ENT_HTML401 =
(which encodes quotes as &#039;) is a better default when encoding, but =
I also think that ENT_HTML5 (which recognises both &#039; and &apos;) is =
a better default when decoding. This is not just when $flags is missing, =
it is also when neither of ENT_HTML401, ENT_HTML5 or ENT_XML1 appears =
explicitly in the bitmask, i.e.:

htmlspecialchars($x, ENT_QUOTES); // should be equivalent to ENT_QUOTES =
| ENT_HTML401

html_entity_decode($x, ENT_QUOTES); // should be equivalent to =
ENT_QUOTES | ENT_HTML5

The difference between ENT_HTML401 and ENT_HTML5 and their practical =
effect (one of them more compatible when encoding and the other more =
compatible when decoding) is probably too subtle for most people, =
assuming they even know the existence of such flags. (In the codebase =
I=E2=80=99m taking care of, there is somewhere a comment that says =
=E2=80=9Chtml_entity_decode does not decode &apos;=E2=80=9D followed by =
code handling manually that specific entity.)

=E2=80=94Claude