Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:34988
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 195.41.46.235 as permitted sender)
To: stas@zend.com (Stanislav Malyshev)
Cc: internals Mailing List <internals@lists.php.net>
Date: Tue, 29 Jan 2008 00:36:32 +0100
Message-ID: <3hpsp3hmn2de4fard8lkpentg24k70jrhg@4ax.com>
References: <200801241426.39756.arnaud.lb@gmail.com> <479A613C.8030604@zend.com>
In-Reply-To: <479A613C.8030604@zend.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [PATCH] Bug #43896 htmlspecialchars returns empty stringon invalid unicode sequence
From: penguin@php.net (Peter Brodersen)

On Fri, 25 Jan 2008 14:22:52 -0800, in php.internals stas@zend.com
(Stanislav Malyshev) wrote:

>> Should really theses functions discard the whole string for a single=20
>> incomplete sequence ?
>
>I think since it is not possible to recover true content of the string,=20
>it is ok to return failure value. Cutting it in random places or=20
>ignoring problems doesn't seem a good idea - it might lead to all kinds=20
>of nasty things, such as security filtering checking one data and=20
>database getting entirely different data.

On the other hand utf8_decode() also expects the input to be UTF-8
encoded, but it replaces incomplete sequences with the character "?".

I don't know if it is a recommended standard for invalid input but I
have seen this conversion as well in a couple of other applications,
e.g. Firefox.

--=20
- Peter Brodersen