[php-src] Issue #21041: Bug: Dom\HTMLDocument corrupts closing tags within scripts.

[email protected] (nickchomey) Mon, 26 Jan 2026 00:55:14 +0000
Newsgroups	php.bugs
Message-ID	<[email protected]>
Issue: https://github.com/php/php-src/issues/21041
Author: nickchomey

### Description

I noticed something peculiar about how HTMLDocument handles html closing tags within script tags. My expectation was that it wouldnt do anything at all and just treat it as a string, but its modifying the closing tag on heading tags.

Here's a small sample php script

```php
<?php
/**
 * Compare old DOMDocument vs new Dom\HTMLDocument for script content handling.
 * Testing various libxml constants to see if any preserve script content.
 */

$html = <<<'HTML'
<!DOCTYPE html>
<html>
    <head></head>
    <body>
        <h3>body heading</h3>
        <script type="text/html" id="tmpl-test">
            <h3>template heading</h3>
        </script>
        <script type="text/javascript">
            var a = "<h1>asdf</h1>";
            var b = `<h1>asdf</h1>`;
            <h1>asdf</h1>
        </script>
    </body>
</html>
HTML;

echo "\n\n=== Old DOMDocument ===\n";
$oldDom = new DOMDocument();
@$oldDom->loadHTML( $html );
echo $oldDom->saveHTML();

echo "\n\n=== New Dom\\HTMLDocument (no flags) ===\n";
$newDom = \Dom\HTMLDocument::createFromString( $html );
echo $newDom->saveHTML();
```

It outputs the following, and you can see that the closing heading tags are just </1>

```
=== Old DOMDocument ===
<!DOCTYPE html>
<html>
    <head></head>
    <body>
        <h3>body heading</h3>
        <script type="text/html" id="tmpl-test">
            <h3>template heading</h3>
        </script>
        <script type="text/javascript">
            var a = "<h1>asdf</h1>";
            var b = `<h1>asdf</h1>`;
            <h1>asdf</h1>
        </script>
    </body>
</html>


=== New Dom\HTMLDocument (no flags) ===
<!DOCTYPE html><html><head></head>
    <body>
        <h3>body heading</h3>
        <script type="text/html" id="tmpl-test">
            <h3>template heading</3>
        </script>
        <script type="text/javascript">
            var a = "<h1>asdf</1>";
            var b = `<h1>asdf</1>`;
            <h1>asdf</1>
        </script>
    
</body></html>
```

Its strange because DOMDocument [was known](https://wiki.php.net/rfc/domdocument_html5_parser?utm_source=chatgpt.com#:~:text=Another%20concern%20highlighted%20in%20PHP%27s%20bug%20tracker%20is%20the%20handling%20of%20closing%20tags%20within%20script%20contexts.%20With%20the%20common%20practice%20of%20embedding%20HTML%20within%20JavaScript%2C%20HTML4%20parsers%20encounter%20problems%20with%20closing%20tags%20within%20JavaScript%20literals) to have issues with closing tags within script tags, and apparently  HTMLDocument was supposed to fix this. But its literally the opposite in this case.

### PHP Version

```plain
PHP 8.4.17 (cli) (built: Jan 16 2026 02:36:09) (ZTS gcc 10.2.1 x86_64)
Copyright (c) The PHP Group
Built by Static PHP <https://static-php.dev> #StandWithUkraine
Zend Engine v4.4.17, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.17, Copyright (c), by Zend Technologies
```

### Operating System

Ubuntu 24.04