note 98133 deleted from function.htmlspecialchars-decode by danbrown

Note Submitter: pinkgothic at gmail dot com 

----

Crikey. Hope the I'm not too late to save the unwitting with this. :(

In response to benharold at mac dot com:

Try the string "&amp;<script>alert('XSS');</script>".

Your code will establish that the decoded string "&<script>alert('XSS');</script>" does not match the original string "&amp;<script>alert('XSS');</script>", presume it is already encoded, and then output the raw variable.

In other words, unfortunately, it *will* screw you, albeit in a different fashion than one might have been looking to avoid. It'll leave you wide open.

There is unfortunately no way to test if a string is already encoded that does not come with these caveats that I know of. I know accidentally double-encoding is a pain, but the solution really just is to escape as close to your actual output as you can muster (in an MVC structure, by escaping in the view) and not before then.