Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112797
MIME-Version: 1.0
References: <CAFv4g+GezouDRdyeyOV2eTvNi0K-jko+jf2QBc+MhjbwNiqR1Q@mail.gmail.com>
 <A2872D6A-CABE-442E-BEF6-33ED06EB3FB5@gmail.com>
In-Reply-To: <A2872D6A-CABE-442E-BEF6-33ED06EB3FB5@gmail.com>
Date: Thu, 7 Jan 2021 15:09:16 +0000
Message-ID: <CAFv4g+H1mxfkRORgmbabk3edDsadFJoCRJE2MHEzZ2WfiC9jrQ@mail.gmail.com>
To: Claude Pache <claude.pache@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000006b1e5805b850d342"
Subject: Re: [PHP-DEV] ENT_COMPAT for htmlentities and htmlspecialchars
From: craig@craigfrancis.co.uk (Craig Francis)

--0000000000006b1e5805b850d342
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 7 Jan 2021 at 14:11, Claude Pache <claude.pache@gmail.com> wrote:

> Hi,
>
> > Le 26 d=C3=A9c. 2020 =C3=A0 12:02, Craig Francis <craig@craigfrancis.co=
.uk> a
> =C3=A9crit :
> >
> > (...)
> > PHP uses the numeric version &#039; with ENT_QUOTES, and it should
> continue
> > to do so - because the named version, &apos; was added in HTML5, but ca=
n
> > still cause problems with legacy parsers; for example Android 4, and th=
e
> > one still in use by Microsoft Outlook (&amp;/&gt;/&lt; was in the
> > original HTML spec, and &quot; was added in HTML2).
> >
> > (...)
>
> I agree that =E2=80=94 in addition to ENT_QUOTES =E2=80=94 ENT_HTML401 (w=
hich encodes
> quotes as &#039;) is a better default when encoding, but I also think tha=
t
> ENT_HTML5 (which recognises both &#039; and &apos;) is a better default
> when decoding.
>



That's a good point for decoding, if I saw:

    echo html_entity_decode(' &#039; &apos; ')

I would expect it to decode both.

I'm tempted to update my PR to use ENT_HTML5 on `html_entity_decode` and
`htmlspecialchars_decode`, to avoid that issue.

But the tests show that it affects a few others, which I think are fine,
but should check what others think:

  &#x0C;    > DECODED, Form Feed
  &#x0D;    > NOT DECODED, Carriage Return
  &#xFDD0;  > NOT DECODED, Invalid character
  &#xFDEF;  > NOT DECODED, Invalid character
  &#xFFFE;  > NOT DECODED, Invalid character
  &#xFFFF;  > NOT DECODED, Invalid character
  &#x2FFFE; > NOT DECODED, Not a character
  &#x2FFFF; > NOT DECODED, Not a character

Craig

--0000000000006b1e5805b850d342--