Re: strip_tags bug or intended behavior?

On 28/02/2024 20:04, Alan Nelson wrote:
> Passing the below example into strip_tags fails because "n<a.length" in the JavaScript is interpreted as an opening tag. All content after "<a.length" is removed.
>
> Does this seem like a bug or intended behavior? On one hand it seems like a bug because this is valid HTML, but on the other hand strip_tags is not documented as supporting JavaScript or intended for it.

A little of both. strip_tags is a naive implementation. It looks like 
it's assuming the <a is the start of a link tag here.

strip_tags doesn't actually try to parse the content using full HTML 
rules, as per the notes on the manual page: 
https://www.php.net/strip_tags#refsect1-function.strip-tags-notes

This is one of the reasons it's generally advised to avoid strip_tags.

To correctly handle HTML content you should use the DOM extension (or 
another HTML parser).

There's a possibility someone may look at this if you file an issue on 
PHP's GitHub tracker but it's equally possible it may just get closed 
with a "won't fix" due to strip_tags nature. 
https://github.com/php/php-src/issues

Personally I would file a separate issue on the Laravel project. While 
it's documented that assertSeeText relies on strip_tags, that's probably 
not really a good idea in my opinion: 
https://laravel.com/docs/10.x/http-tests#assert-see-text

This issue can be worked around by putting spaces around the < in the JS 
code: https://3v4l.org/VZ6t6