url encoding

Bonjour,
As we develop further the Mediawiki parser, I got stuck by some URLs 
built up from wiki pages names. Mediawiki accepts spaces (and certainly 
more other special chars) in pages names.
But the Xhtml render only htmlspecialchar() them what means will let 
spaces untouched, which is not correct in an URL.

That concerns Interwiki, Wikilink and Phplookup rules.

As a quick workaround, I changed the htmlspecialchar() into urlencode().
That corrects this bad behavior, however I'm very unsure about this 
change, why I request your check about it:
* does urlencode() give the same protection against XSS and so ?
  Should we use some combination of both urlencode and htmspecialchar() ?
* it is theoretically possible to use (at least) the Interwiki facility 
to link to not only wiki pages but more generally subdirectories + query 
parameters from external pre-configured sites. I wonder if some users do 
it. In this case, the urlencode() would destroy the url.
  Should I make this behavior optional/configurable ?

It appears that urlencode() makes '+' from spaces, which is not 
compliant. Is it better to use rawurlencode() instead ? (it makes right 
%20 of them)
Moreover, these functions will also encode the national characters (non 
ascii), is it always desirable ?

A propos Xhtml compliance, we eventually also have the question of the & 
in query part, full xml compliance would require them to be &  (w3c 
recommends ';' only, but not all browsers know it) ...

Finally, I believe the Text_Wiki_Render  abstract class should furnish 
some own url encoding method, user configurable and over writable by 
each renderer,
the same as we need (for text) to generalize the text encoding user 
choice between htmlentities, htmlspecialchar or none in the Xhtml 
renderer. ( http://pear.php.net/bugs/bug.php?id=5953 )
For example, the Docbook renderer will require some cleanup case ISO 
encoding is asked ... which will be different from the Xhtml one, certainly.
That means having 2 methods urlencode() and textencode() in these render 
classes, what will be used instead of the raw php calls urlencode() and 
htmspecialchar()/htmlentities().

Ah ah, again some "unsorted" romance :)
à+
-- 
toggg

-- 
PEAR Development Mailing List (http://pear.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php