php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #31191 "unterminated entity reference" when using the value parameter to createElement
Submitted: 2004-12-20 06:46 UTC Modified: 2004-12-20 08:10 UTC
Votes:37
Avg. Score:4.1 ± 1.0
Reproduced:33 of 33 (100.0%)
Same Version:8 (24.2%)
Same OS:25 (75.8%)
From: php at owenpshaw dot net Assigned:
Status: Wont fix Package: DOM XML related
PHP Version: 5.0.3 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: php at owenpshaw dot net
New email:
PHP Version: OS:

 

 [2004-12-20 06:46 UTC] php at owenpshaw dot net 
Description:
------------
It looks like no escaping is done to the optional "value" parameter in the DomDocument::createElement() and DomDocument::createElementNS().  The online documentation doesn't specify what the correct behavior should be, and it's not part of the DOM standard, so it seems possible that this is a bug.
  

Reproduce code:
---------------
$document = new DomDocument();
$element = $document->createElement('foo','&');

Expected result:
----------------
I would expect the '&' (or any other character that should be escaped) to be escaped as if I had used DomDocument::createTextNode().

Actual result:
--------------
Warning: unterminated entity reference in [FILE] on line [LINE]

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-12-20 08:10 UTC] chregu@php.net 
We discussed that topic (internally) and we decided not to implement escaping here. If I remember correctly, one of the reason was for backwards compatibility, as we discovered this  after 5.0.0 was released.

Use $doc->createTextNode() if you want to have automatic escaping
 [2010-01-16 22:13 UTC] svn@php.net 
Automatic comment from SVN on behalf of bjori
Revision: http://svn.php.net/viewvc/?view=revision&revision=293630
Log: Rephrase after reading bug#31191 (see bug#50742)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Dec 21 18:01:29 2024 UTC