note 98133 added to function.htmlspecialchars-decode

Crikey. Hope the I'm not too late to save the unwitting with this. :(

In response to benharold at mac dot com:

Try the string "&amp;<script>alert('XSS');</script>".

Your code will establish that the decoded string "&<script>alert('XSS');</script>" does not match the original string "&amp;<script>alert('XSS');</script>", presume it is already encoded, and then output the raw variable.

In other words, unfortunately, it *will* screw you, albeit in a different fashion than one might have been looking to avoid. It'll leave you wide open.

There is unfortunately no way to test if a string is already encoded that does not come with these caveats that I know of. I know accidentally double-encoding is a pain, but the solution really just is to escape as close to your actual output as you can muster (in an MVC structure, by escaping in the view) and not before then.
----
Server IP: 217.160.235.204
Probable Submitter: 217.92.147.99
----
Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars-decode.php
Edit        -- https://master.php.net/note/edit/98133
Del: integrated  -- https://master.php.net/note/delete/98133/integrated
Del: useless     -- https://master.php.net/note/delete/98133/useless
Del: bad code    -- https://master.php.net/note/delete/98133/bad+code
Del: spam        -- https://master.php.net/note/delete/98133/spam
Del: non-english -- https://master.php.net/note/delete/98133/non-english
Del: in docs     -- https://master.php.net/note/delete/98133/in+docs
Del: other reasons-- https://master.php.net/note/delete/98133
Reject      -- https://master.php.net/note/reject/98133
Search      -- https://master.php.net/manage/user-notes.php