note 98202 added to function.htmlspecialchars-decode

[@Editors: Couldn't find this note on the mirrors, presuming it got dropped, so posting it again; was pretty sure legitimate posters get notified via e-mail if their note is dropped, thus presuming glitch. If I'm mistaken, please accept my apologies.]

Please BE CAREFUL when using benharold at mac dot com's trick. As they themselves have said: "Now, if your dealing with text that is a mixed bag (has HTML entities and non-HTML entities) you're on your own."

What does that mean? That means you should never trust user input to that function.

Why? Well, take a look at this example:

<?php

$var = "&amp;<script>alert('XSS!');</script>";
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;

?>

htmlspecialchars_decode($var) will evaluate to "&<script>alert('XSS!');</script>", which is NOT the same as $var. Accordingly, $var will be returned raw (since the ternary operator routes to $var rather than htmlspecialchars($var)), even though it should be getting htmlspecialchars() sanitised.

Echoing the string, which you might after that line presume to be htmlspecialchars() encoded, will thus open you to cross-site scripting.

Unfortunately, there is no reliable way to check whether output has been sanitised or not that does not come with this caveat (that I know of). The only 'guard' against repeat-encoding your output is to exclusively do it as close to the final output as possible, e.g. if you have a MVC architecture, that you sanitise in the view itself.
----
Server IP: 69.147.83.197
Probable Submitter: 217.92.147.99
----
Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars-decode.php
Edit        -- https://master.php.net/note/edit/98202
Del: integrated  -- https://master.php.net/note/delete/98202/integrated
Del: useless     -- https://master.php.net/note/delete/98202/useless
Del: bad code    -- https://master.php.net/note/delete/98202/bad+code
Del: spam        -- https://master.php.net/note/delete/98202/spam
Del: non-english -- https://master.php.net/note/delete/98202/non-english
Del: in docs     -- https://master.php.net/note/delete/98202/in+docs
Del: other reasons-- https://master.php.net/note/delete/98202
Reject      -- https://master.php.net/note/reject/98202
Search      -- https://master.php.net/manage/user-notes.php