Bug #74371 [Com]: strip_tags altering attributes

Edit report at https://bugs.php.net/bug.php?id=74371&edit=1

 ID:                 74371
 Comment by:         spam2 at rhsoft dot net
 Reported by:        php-bugs at aspectis dot net
 Summary:            strip_tags altering attributes
 Status:             Open
 Type:               Bug
 Package:            *General Issues
 PHP Version:        7.1.3
 Block user comment: N
 Private report:     N

 New Comment:

you don't get it - the whole purpose of strip_tags is to get rid auf dangerous chars like < and >


Previous Comments:
------------------------------------------------------------------------
[2017-04-04 19:56:53] php-bugs at aspectis dot net

This may be true for XHTML, but in HTML 4 and 5 "<" and ">" are perfectly valid characters for attribute values.

------------------------------------------------------------------------
[2017-04-04 19:45:39] spam2 at rhsoft dot net

your source code is just plain wrong when it contains < or > because these chars needs to be encoded as entities and the whole purpose of strip_tags() is to FIX such issues to PREVENT that your tag itself get closed by unencoded value

------------------------------------------------------------------------
[2017-04-04 18:41:26] php-bugs at aspectis dot net

Description:
------------
The manual claims that strip_tags "does not modify any attributes on the tags that you allow" (http://www.php.net/function.strip-tags), which unfortunately isn't quite true:

The characters "<" and ">" get stripped from all attribute values.

All versions at least from 5.4 seem to be affected.

Test script:
---------------
echo strip_tags('<img src="example.jpg" alt=":> :<">', '<img>');


Expected result:
----------------
<img src="example.jpg" alt=":> :<">

Actual result:
--------------
<img src="example.jpg" alt=": :">


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74371&edit=1